PT-2025-49503 · Projectworlds · Advanced Library Management System

Yudeshui · Published 2025-12-08 · Updated 2026-01-03 · CVE-2025-14212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions projectworlds Advanced Library Management System version 1.0

Description A flaw exists in projectworlds Advanced Library Management System that allows for SQL injection. This issue is related to an unknown functionality within the /member search.php file. Manipulation of the roll number argument can lead to a successful attack, which can be launched remotely. An exploit for this issue has been published.

Recommendations Apply any available updates or patches to address the vulnerability in the affected file. As a temporary workaround, consider restricting or carefully validating the roll number argument in the /member search.php file to prevent SQL injection attacks.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-14212

Affected Products

Advanced Library Management System

References · 10

• 🔥 https://github.com/rassec2/dbcve/issues/11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-14212 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14212 · Vendor Advisory
• https://vuldb.com/?id.334655 · Note
• https://t.me/cveNotify/145053 · Telegram Post
• https://vuldb.com/?ctiid.334655 · Note
• https://vuldb.com/?submit.700977 · Note
• https://t.me/CVEtracker/39082 · Telegram Post
• https://twitter.com/RedPacketSec/status/1997903522017259564 · Twitter Post
• https://twitter.com/SecReportCVE/status/2007408253706150059 · Twitter Post