CVE-2025-13580

Executive Summary

CVE-2025-13580 is a SQL injection vulnerability in code-projects Library System version 1.0, affecting an unknown function within the /mail.php script. The flaw is triggered by manipulation of the ID argument, allowing an attacker to inject arbitrary SQL into backend database queries. The vulnerability is remotely exploitable, has been publicly disclosed, and a public proof-of-concept exists; because it remains unpatched by the vendor, any internet-exposed deployment of this application is at risk.

Technical Analysis

The vulnerability resides in the web application code-projects Library System, a PHP-based library management system distributed as version 1.0. According to the CNA-provided information, the affected component is the file /mail.php, and the injection vector is the ID argument. The NVD description classifies this as SQL injection (CWE-74 family — injection), where user-supplied input is incorporated into a SQL query without adequate sanitization or parameterization.

Key technical facts derivable from the provided intelligence:

• Attack surface: The /mail.php endpoint, which is reachable over the network (AV:N).
• Input vector: The ID parameter, manipulated by the attacker to alter the structure of the underlying SQL statement.
• Authentication requirement: The CVSS vector indicates PR:L (low privileges required), meaning the attacker must possess some level of authenticated access — likely a low-privileged user account — to reach the vulnerable functionality.
• Impact subscores: C:L / I:L / A:L — limited confidentiality, integrity, and availability impact. This is consistent with a targeted injection that may expose or modify portions of the database but does not immediately yield full system compromise.

Because the NVD description explicitly states "an unknown function" of /mail.php, the exact internal function name or code path is not publicly specified. The mechanism is nonetheless a classic SQL injection: the application fails to properly validate or escape the ID value before using it in a database query. Depending on the query context (e.g., a SELECT, UPDATE, or DELETE), an attacker could retrieve, alter, or delete records from the backend database — including sensitive user, library, or administrative data.

The CWE classification as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) aligns with the typical root cause: missing input validation and lack of prepared statements.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the limited data provided. No public exploit code or detailed PoC is available; the steps below describe the attack at the vulnerability-class level. No specific code patterns, function names, or parameter values are fabricated.

1. Reconnaissance and target identification An attacker scans for internet-exposed instances of code-projects Library System 1.0. This can be done using Shodan or similar search engines with queries such as http.title:"Library System" or http.html:"mail.php". The attacker then confirms the presence of the /mail.php endpoint.

2. Authentication / access acquisition Because the CVSS vector specifies PR:L, the attacker requires low-privileged credentials. This could be obtained through default accounts, credential stuffing, or a separate low-severity flaw. Alternatively, if the endpoint is reachable without authentication in some deployments, the PR:L rating may still reflect the worst-case assessed privilege requirement.

3. Triggering the SQL injection The attacker sends a crafted HTTP request to /mail.php in which the ID parameter is set to a malicious SQL payload. For example, a classic injection might attempt to alter the query logic (e.g., using boolean-based or UNION-based techniques) to bypass intended filters or extract data. The exact payload depends on the unsanitized query context, which is not publicly documented. The manipulation of the ID argument causes the backend database to execute attacker-controlled SQL fragments.

4. Post-exploitation impact Successful exploitation could allow:

   • Confidentiality: Retrieval of database contents (user credentials, library records, email data, etc.), with limited scope as reflected by C:L.
   • Integrity: Modification or insertion of data, potentially enabling privilege escalation within the application (I:L).
   • Availability: Deletion or corruption of data, or disruption of service, with limited impact (A:L). Full database compromise would typically require elevated privileges or additional chaining; the CVSS scores suggest a constrained but real impact.

Impact Assessment

• CVSS Score: 6.3 (Medium) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
• Business impact: Organizations using code-projects Library System 1.0 for library management, cataloging, or related functions face risks of data leakage, data tampering, and service disruption. Because the system may store user credentials and personal information, a SQL injection could lead to privacy breaches and regulatory non-compliance (e.g., GDPR, HIPAA if health-related records are involved, though unlikely for a general library system).
• Blast radius: Any internet-facing or internal instance of the application at version 1.0 is affected. The requirement for low privileges limits indiscriminate worm-like exploitation, but insider threats or attackers with a valid low-privileged account can easily weaponize this flaw.
• EPSS: 0.00306 (21.4th percentile) — the probability of exploitation in the wild within 30 days is currently low, but public disclosure and PoC availability increase the likelihood of opportunistic attacks.
• CISA KEV: Not listed. No evidence of active exploitation in the wild at the time of this report.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against code-projects Library System mail.php
id: 8b9c3f2e-1a4d-4e7b-9c2a-5f6e8d7c9b0a
status: experimental
description: Detects SQL injection patterns in HTTP requests targeting the ID parameter of /mail.php in code-projects Library System 1.0.
author: Threat Intelligence Team
date: 2025-06-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection_uri:
        cs-uri-stem|endswith: '/mail.php'
    selection_payload:
        cs-uri-query|contains:
            - 'id='
            - 'ID='
    selection_sqli:
        cs-uri-query|contains:
            - "'"
            - '"'
            - '--'
            - '/*'
            - '*/'
            - ' OR '
            - ' AND '
            - ' UNION '
            - ' SELECT '
            - ' SLEEP('
            - ' BENCHMARK('
            - ';--'
    condition: selection_uri and selection_payload and selection_sqli
fields:
    - c-ip
    - cs-uri-query
    - cs-method
falsepositives:
    - Legitimate application requests containing apostrophes in search terms
level: high
tags:
    - attack.t1190
    - cve.2025.13580

YARA Rule

rule CVE_2025_13580_Library_System_SQLi
{
    meta:
        description = "Detects SQL injection payloads targeting the ID parameter in /mail.php of code-projects Library System"
        author = "Threat Intelligence Team"
        date = "2025-06-10"
        cve = "CVE-2025-13580"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-13580"

    strings:
        $mail_php = "/mail.php" ascii wide nocase
        $param_id = "id=" ascii wide nocase
        $sqli1 = "' OR " ascii wide nocase
        $sqli2 = "' AND " ascii wide nocase
        $sqli3 = " UNION SELECT " ascii wide nocase
        $sqli4 = " SLEEP(" ascii wide nocase
        $sqli5 = " BENCHMARK(" ascii wide nocase
        $sqli6 = "--" ascii wide
        $sqli7 = "/*" ascii wide
        $payload = "1=1" ascii wide

    condition:
        $mail_php and $param_id and (any of ($sqli*) or $payload)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-13580 SQL Injection Attempt Against code-projects Library System mail.php"; flow:to_server,established; http.uri; content:"/mail.php"; http.uri; content:"id="; nocase; pcre:"/(\%27)|(')|(\-\-)|(\%23)|(#)/i"; pcre:"/((\%3D)|(=))[^\n]*((\%27)|(')|(\-\-)|(\%3B)|(;))/i"; pcre:"/\w*((\%27)|('))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/i"; pcre:"/((\%27)|('))union/i"; reference:cve,2025-13580; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-13580; classtype:web-application-attack; sid:100013580; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method == "GET" and url.path == "/mail.php" and url.query contains "id="]
  [network where http.request.method == "GET" and url.path == "/mail.php" and url.query regex~ ".*((')|(%27)|(--)|(%2D%2D)|(union.*select)|(sleep\\()|(benchmark\\())+.*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache:access
| search uri_path="/mail.php" AND (uri_query="*id=*" OR uri_query="*ID=*")
| regex uri_query="(?i)(\%27|'|\-\-|\%23|#|union.*select|sleep\(|benchmark\(|or\s+\d+\s*=\s*\d+)"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_query, http_user_agent
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2025-13580">
  <rule id="10013580" level="12">
    <if_sid>31100</if_sid>
    <id>^/mail\.php</id>
    <match>id=</match>
    <regex>(?i)(\%27|'|\-\-|\%23|#|union.*select|sleep\(|benchmark\()</regex>
    <description>CVE-2025-13580: SQL Injection attempt detected against code-projects Library System mail.php (ID parameter)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or workaround is available from any tracked source.

Immediate mitigations (no patch available):

1. Restrict network access: Block or limit external access to the Library System application, especially /mail.php. Use a VPN, IP allowlisting, or a reverse proxy with strict access controls.
2. Web Application Firewall (WAF): Deploy a WAF with SQL injection rulesets (e.g., OWASP ModSecurity Core Rule Set) to detect and block common injection patterns targeting the ID parameter.
3. Input validation at the edge: If possible, implement a reverse-proxy filter that sanitizes or blocks suspicious characters in the ID parameter before reaching the application.
4. Least privilege: Ensure the database user associated with the application has the minimum necessary permissions. This limits the impact of a successful injection.

Patch/upgrade steps:

• No official patch exists. Monitor the vendor's repository (code-projects) for any future security fixes. Until then, consider isolating or decommissioning the vulnerable instance if feasible.
• If the application is critical, evaluate alternative library management solutions with active security maintenance.

Long-term hardening:

• Replace unprepared SQL queries with parameterized statements (prepared statements) and enforce strict server-side input validation.
• Conduct a security audit of the entire codebase, focusing on all input vectors.
• Implement a secure software development lifecycle (SDLC) with regular vulnerability scanning and penetration testing.

References

1. NVD — CVE-2025-13580: https://nvd.nist.gov/vuln/detail/CVE-2025-13580
2. CNA (code-projects) advisory — referenced in NVD description.
3. CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: https://cwe.mitre.org/data/definitions/74.html
4. OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
5. CISA Known Exploited Vulnerabilities Catalog: Not applicable (CVE-2025-13580 is not listed as of report date).

No known threat actor campaigns or in-the-wild exploit activity have been reported. Public exploit code is not available, but public disclosure and PoC availability may increase the risk of opportunistic exploitation.