PT-2025-47837 · Unknown · Ashraf-Kabir Travel-Agency

Www234 · Published 2025-11-23 · Updated 2025-12-04 · CVE-2025-13545

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ashraf-kabir travel-agency versions prior to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3

Description A security issue exists in ashraf-kabir travel-agency. The manipulation of the edit pack argument in the /admin area/index.php file leads to SQL injection. This attack can be initiated remotely. The exploit has been publicly disclosed. Continuous delivery with rolling releases is used, and the vendor did not respond to early disclosure attempts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-13545

Affected Products

Ashraf-Kabir Travel-Agency

References · 11

• 🔥 https://github.com/www223-ai/CVE/blob/main/travel-sql.docx · Exploit
• https://osv.dev/vulnerability/CVE-2025-13545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13545 · Security Note
• https://vuldb.com/?submit.690978 · Note
• https://t.me/cveNotify/143695 · Telegram Post
• https://vuldb.com/?id.333312 · Note
• https://vuldb.com/?ctiid.333312 · Note
• https://t.me/CVEtracker/38009 · Telegram Post
• https://twitter.com/dailycve/status/1996624731815149615 · Twitter Post
• https://twitter.com/CVEnew/status/1992542642123796568 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1992541492288557238 · Twitter Post