CVE-2025-13300CWE-74CWE-89sql-injection

CVE-2025-13300

High · published November 18, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

⚠️ Heads up! A sneaky SQL injection vulnerability has been uncovered in the itsourcecode Web-Based Internet Laboratory Management System 1.0, lurking in the controller file! This flaw is like a restaurant that doesn’t check what ingredients the delivery driver brings in. If they don’t verify the order, someone could slip in a dangerous ingredient without anyone noticing! With this SQL injection vulnerability, an attacker could potentially access sensitive database information or manipulate data in ways that could compromise the entire system. Although it's not publicly exploited yet, left unaddressed, it can lead to unauthorized data exposure and integrity issues.

Put simply

This flaw is like a restaurant that doesn’t check what ingredients the delivery driver brings in. If they don’t verify the order, someone could slip in a dangerous ingredient without anyone noticing! This vulnerability allows remote attackers to manipulate SQL queries through unsanitized input in the /settings/controller.php file, which can lead to unauthorized access or data modification.

What to do

With this SQL injection vulnerability, an attacker could potentially access sensitive database information or manipulate data in ways that could compromise the entire system. Although it's not publicly exploited yet, left unaddressed, it can lead to unauthorized data exposure and integrity issues. To safeguard against this, immediately patch to the latest version of the itsourcecode Web-Based Internet Laboratory Management System. It’s also essential to sanitize all user inputs and implement prepared statements for database queries to prevent SQL injection. You've got this! 🦸 Take these steps, and you'll secure your system in no time!

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.3th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-11-18T02:15Z
Affected products (1)
ProductVersionsFixed in
itsourcecode/web-based_internet_laboratory_management_systemall versions—
References (5)
EPSS history
Timeline
  • 17 NOV 20:32Z
    itsourcecode Web-Based Internet Laboratory Management System controller.php sql injection
    cvelistv5