CVE-2025-13546
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability was detected in ashraf-kabir travel-agency up to commit 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3 in the file /results.php of the Search component. Manipulation of the user_query argument leads to SQL injection. The attack can be launched remotely, and the exploit is now public and may be used. The product does not use versioning, so affected and unaffected releases are unavailable.
Risk Assessment
A remote attacker could execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The public availability of the exploit increases the risk of rapid exploitation.
Recommendation
Apply patches or mitigations such as input validation and parameterized SQL queries in /results.php. Consider deploying a WAF and restricting access to the application.
Other vulnerabilities in ashraf-kabir travel-agency
See all- CVE-2025-13545Medium
A security vulnerability was detected in ashraf-kabir travel-agency up to commit 1f25aa0 in /admin_area/index.php. Manipulating the edit_pack argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.
- CVE-2025-13544Medium
A weakness was identified in ashraf-kabir travel-agency up to commit 1f25aa0 in /customer_register.php allowing unrestricted upload. The attack can be launched remotely and the exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality of the file /results.php of the component Search. The manipulation of the argument user_query results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS