PT-2025-47143 · Projectworlds · Advanced Library Management System

Choco094Late · Published 2025-11-17 · Updated 2025-11-17 · CVE-2025-13278

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions projectworlds Advanced Library Management System version 1.0

Description A SQL injection issue exists in projectworlds Advanced Library Management System version 1.0. The issue is located in the /borrowed book search.php file, within an unknown function. Manipulation of the datefrom and dateto arguments can lead to SQL injection. The attack can be initiated remotely, and details of the exploit have been publicly disclosed.

Recommendations Apply a fix for projectworlds Advanced Library Management System version 1.0 to address the SQL injection issue in the /borrowed book search.php file. As a temporary workaround, restrict access to the /borrowed book search.php file to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-13278

Affected Products

Advanced Library Management System

References · 10

• 🔥 https://github.com/CH0ico/CVE_choco_1/blob/master/report.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-13278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13278 · Security Note
• https://t.me/CVEtracker/37493 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990416234014294077 · Twitter Post
• https://vuldb.com/?ctiid.332613 · Note
• https://twitter.com/CVEnew/status/1990407295545581572 · Twitter Post
• https://t.me/cveNotify/143024 · Telegram Post
• https://vuldb.com/?id.332613 · Note
• https://vuldb.com/?submit.690797 · Note