CVE-2025-13578

Executive Summary

CVE-2025-13578 is a remote SQL injection vulnerability in the login component of Code-Projects Library System 1.0, affecting the /index.php login script via manipulation of the Username argument. The flaw is network-reachable, requires no authentication or user interaction, and an exploit has been publicly disclosed, lowering the barrier to abuse. Impact is rated Moderate (CVSS 7.3), with potential for authentication bypass and unauthorized access to or modification of backend library data.

Technical Analysis

The vulnerability resides in the login routine of Code-Projects Library System 1.0, a PHP/MySQL web application distributed as an open-source project. Per the NVD description, the affected code path is the file /index.php, within its Login component. The application does not adequately sanitize or parameterize the Username argument before incorporating it into a database query, resulting in classic SQL injection (CWE-74, Improper Neutralization of Special Elements in Output Used by a Downstream Component).

The attack surface is the unauthenticated login form — the first interaction point any visitor reaches. Because the injection point (Username) is processed prior to any session or role check, an attacker does not need existing credentials or a valid session to reach the vulnerable query. The NVD entry does not enumerate the specific function or SQL statement, only that an "unknown function" in /index.php is affected; therefore the precise query structure cannot be confirmed from the provided data. What is confirmable is the class of defect: user-controlled input flows into a SQL statement without proper neutralization.

The Login component performs an authentication query. Successful injection of the Username field can alter the logic of that query — the canonical pattern for this class being an injected boolean or comment sequence that makes the authentication predicate evaluate as true, or that unions attacker-supplied data into the result set. Such logic manipulation is consistent with authentication bypass, which aligns with the CVSS confidentiality and integrity subscripts of Low (C:L/I:L).

CVSS 3.1 vector analysis:

• AV:N — exploitable over the network, no adjacent or local access required.
• AC:L — no special conditions; the vulnerable input is directly reachable.
• PR:N — no privileges required; the login page is unauthenticated.
• UI:N — no victim interaction; the attacker triggers the flaw directly.
• S:U — scope unchanged; impact is confined to the application's security authority.
• C:L/I:L/A:L — partial, not total, compromise of confidentiality, integrity, and availability.

The absence of a Nuclei template and of published exploit code (as tracked) does not reduce exposure: the NVD record explicitly states the exploit "has been disclosed to the public and may be used." EPSS is 0.00387 (30.7th percentile), indicating low modeled near-term exploitation probability in aggregate — but the public disclosure means targeted use against exposed instances remains realistic.

Exploitation Scenarios

The following chain is described at the vulnerability-class level. No public PoC code was tracked, and the NVD description does not disclose the underlying query, function name, or payload structure. Specific implementation details beyond the Username argument in /index.php cannot be asserted.

1) Reconnaissance / target identification. An attacker scans for internet-exposed instances of Code-Projects Library System 1.0 using fingerprinting dorks (see Shodan dorks). The login page at /index.php is the primary recognizable surface. Public disclosure of the CVE means the target profile is already widely known.

2) Triggering the flaw. The attacker submits a crafted value into the Username field of the login form on /index.php. Because the field is reflected into a SQL query without proper neutralization, the injected content changes the query's logic when the request is processed by the backend database. No authentication, session, or prior access is needed — the flaw is reachable on the first request.

3) Execution method. At the vulnerability-class level, the attacker manipulates the Username parameter to alter the SQL predicate governing the login check. This is consistent with authentication-bypass injections (logic-only payloads) or with data-extraction injections (UNION-style payloads), depending on query construct. The precise syntactic payload cannot be stated from the available description — only the injection point (Username in /index.php) is confirmed.

4) Post-exploitation impact. A successful authentication bypass grants the attacker an application session, exposing whatever data and functions are available behind the login (library records, user data, administrative views, depending on application configuration). This corresponds to the C:L and I:L scores — partial exposure and partial ability to alter data. If the injected query permits broader database access, the blast radius could extend beyond the application schema, though the CVSS scope (S:U) indicates primary impact is contained to the application. Availability impact (A:L) would require a query pattern that degrades or interrupts the database — not established by the data provided.

Impact Assessment

• Confidentiality (Low): Authentication bypass enables access to resources gated behind the login, potentially exposing user and catalog data.
• Integrity (Low): An authenticated bypass session may allow modification of records according to the application's privilege model; injection into a data-modifying query could also corrupt records.
• Availability (Low): No direct denial-of-service vector is described; the Low rating reflects the potential for query-induced disruption, not a confirmed mechanism.
• Blast radius: The flaw is confined to the application (scope unchanged). Systems hosting Code-Projects Library System 1.0 with internet-exposed /index.php login pages are in scope. Because the product is a small open-source project often deployed by educational institutions or for demonstration, deployments may be under-maintained and unlikely to receive a patch.
• Business impact: Unauthorized access to a library management backend can expose patron/staff data and permit tampering with inventory or loan records, creating data-integrity and privacy exposure. The public nature of the disclosure makes opportunistic scanning likely.

Detection Guidance

Sigma Rule

title: Code-Projects Library System Login SQL Injection Attempt (CVE-2025-13578)
id: 8c2f2c1e-1357-4b8a-9d12-librarysqli0001
status: experimental
description: Detects SQL injection indicators in requests targeting the Library System login (Username argument in /index.php).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-13578
author: Valters IT Threat Intelligence
date: 2025/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: '/index.php'
  selection_args:
    cs-uri-query|contains:
      - 'Username='
      - 'username='
  selection_sqli:
    cs-uri-query|contains:
      - "'"
      - '"'
      - '--'
      - 'UNION'
      - 'SELECT'
      - 'OR 1=1'
      - 'OR%201%3D1'
      - 'SLEEP('
      - 'BENCHMARK('
      - 'INFORMATION_SCHEMA'
  condition: selection_uri and selection_args and selection_sqli
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate usernames containing apostrophes
  - Automated scanners generating benign malformed input
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2025.13578

YARA Rule

rule CVE_2025_13578_LibrarySystem_SQLi
{
    meta:
        description = "Detects SQL injection payload patterns targeting Code-Projects Library System login (CVE-2025-13578)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-13578"
        date = "2025-01-01"
        severity = "high"
    strings:
        $login = "index.php" nocase
        $uname = "Username=" nocase
        $sqli1 = "OR 1=1" nocase
        $sqli2 = "' OR '" nocase
        $sqli3 = "'--" nocase
        $sqli4 = "UNION SELECT" nocase
        $sqli5 = "INFORMATION_SCHEMA" nocase
        $sqli6 = "SLEEP(" nocase
        $sqli7 = "BENCHMARK(" nocase
    condition:
        $login and (1 of ($sqli*)) or ($uname and 1 of ($sqli*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-13578 Code-Projects Library System Login SQL Injection Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"index.php"; http.uri; content:"Username="; nocase; http.uri; pcre:"/(\%27|')|(--)|(UNION\s+SELECT)|(OR\s+1=1)|(SLEEP\()|(BENCHMARK\()|(INFORMATION_SCHEMA)/i"; classtype:web-application-attack; reference:cve,2025-13578; reference:url,nvd.nist.gov/vuln/detail/CVE-2025-13578; sid:202513578; rev:1; metadata:created_at 2025_01_01, updated_at 2025_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where
     http.request.method in ("GET","POST") and
     url.path : "/index.php" and
     url.query contains "Username=" and
     (url.query contains "'" or url.query contains "--" or
      url.query contains "UNION SELECT" or
      url.query contains "OR 1=1" or
      url.query contains "SLEEP(" or
      url.query contains "BENCHMARK(")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where match(uri_path, "(?i)/index\.php")
| where match(uri_query, "(?i)username=")
| where match(uri_query, "(?i)('|--|union\s+select|or\s+1=1|sleep\(|benchmark\(|information_schema)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as payloads by src_ip, uri_path, status
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,attack,sqli,">
  <rule id="202513578" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100,31101</if_sid>
    <url>/index\.php</url>
    <match>Username=</match>
    <regex type="pcre2">(?i)('|--|union\s+select|or\s+1=1|sleep\(|benchmark\(|information_schema)</regex>
    <description>CVE-2025-13578: SQL injection attempt against Code-Projects Library System login (Username in /index.php)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2025_13578,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence exists from any tracked source, no vendor fix, no workaround, and no tracked affected-version table. The product remains unpatched.

1) Immediate mitigations

• Restrict network exposure: do not publish the Library System login (/index.php) to the public internet. Place it behind a VPN, reverse proxy with authentication, or IP allowlisting.
• Deploy a WAF in front of the application with SQL-injection virtual patching for requests containing SQL metacharacters in the Username parameter.
• Disable or remove the deployment if the system is no longer actively used — the project is unmaintained in terms of security response.
• Monitor web logs — using the detection rules above — for injection attempts against /index.php.

2) Patch / upgrade

• There is no vendor patch or fixed version to upgrade to. Confirm with the Code-Projects repository whether any updated release exists; absent a fix, upgrading is not an available remediation.
• If source modification is within the operator's control, the durable fix is to convert the vulnerable query to a parameterized (prepared) statement and to validate the Username input. This is a code-level remediation of the SQL injection class, applied to the Username handling in /index.php. It must be developed and tested by the operator because no official fix is supplied.

3) Long-term hardening

• Standardize on parameterized queries / prepared statements across all database access in the application.
• Apply input validation and output encoding; reject or escape SQL metacharacters at the boundary.
• Run the application with a least-privilege database account (no DDL, no cross-schema access).
• Maintain an inventory of open-source web apps in production and track CVEs — this class of project rarely ships coordinated patches.
• Log and alert on authentication-layer anomalies (unexpected successful logins, unusual Username payloads).

References

• NVD — CVE-2025-13578: https://nvd.nist.gov/vuln/detail/CVE-2025-13578
• CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Code-Projects Library System (project source/listing): https://code-projects.org/
• CISA Known Exploited Vulnerabilities Catalog (not listed for CVE-2025-13578): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No named threat actor campaign or confirmed exploit-in-the-wild activity is associated with CVE-2025-13578 in the provided intelligence. The NVD record states the exploit has been disclosed to the public and may be used; no tracked exploit code or Nuclei template was identified.