CVE-2025-13545
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A security vulnerability was detected in ashraf-kabir travel-agency up to commit 1f25aa0 in /admin_area/index.php. Manipulating the edit_pack argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.
Risk Assessment
An attacker could remotely execute SQL queries in the admin panel, risking data compromise or leakage. The vendor's lack of response makes obtaining a fix difficult.
Recommendation
Apply your own fix validating the edit_pack parameter or restrict access to /admin_area/index.php; consider replacing the unmaintained product.
Other vulnerabilities in ashraf-kabir travel-agency
See all- CVE-2025-13546Medium
A vulnerability was detected in ashraf-kabir travel-agency up to commit 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3 in the file /results.php of the Search component. Manipulation of the user_query argument leads to SQL injection. The attack can be launched remotely, and the exploit is now public and may be used. The product does not use versioning, so affected and unaffected releases are unavailable.
- CVE-2025-13544Medium
A weakness was identified in ashraf-kabir travel-agency up to commit 1f25aa0 in /customer_register.php allowing unrestricted upload. The attack can be launched remotely and the exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an unknown functionality of the file /admin_area/index.php. The manipulation of the argument edit_pack leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS