Listen to this Post
The CVE-2025-13346 vulnerability is an unauthenticated SQL injection flaw within the `/ajax.php?action=save_station` endpoint of SourceCodester Train Station Ticketing System 1.0. The vulnerability arises because user-supplied input passed to the `id` and `station` parameters is not properly sanitized before being incorporated into an SQL query. An attacker can send a crafted HTTP POST request containing malicious SQL code within these parameters. This code is then executed directly by the backend database, allowing the attacker to read, modify, or delete sensitive information from the database, such as user credentials and ticketing records, without the need for authentication.
Platform: SourceCodester Ticketing System
Version: 1.0
Vulnerability: SQL Injection
Severity: Medium
date: 11/18/2025
Prediction: Patch expected Q1 2026
What Undercode Say:
curl -X POST http://<target>/ajax.php?action=save_station -d "id=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -&station=test"
' UNION SELECT username, password FROM users--
How Exploit:
Remote attackers exploit the `id` and `station` parameters via unsanitized input in POST requests, enabling database manipulation and data exfiltration without credentials.
Protection from this CVE:
Parameterized queries.
Input sanitization.
Web Application Firewall.
Impact:
Unauthenticated database access.
Data confidentiality loss.
Data integrity compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
