CVE-2025-13276

Root

Cause An SQL injection vulnerability has been identified in the g33kyrash/Online-Banking-System, affecting code within /index.php. The flaw lies in the handling of the Username argument, which is improperly sanitized before being used in a database query. This allows an attacker to inject arbitrary SQL commands by manipulating this parameter [1]. The project uses a rolling-release model, so specific version identifiers are not provided; however, the vulnerable state is captured in the commit 12dbfa690e5af649fb72d2e5d3674e88d6743455 [1].

Exploitation

An attacker can exploit this vulnerability remotely without requiring any prior authentication. The attack vector is straightforward: by sending a crafted HTTP request to the target's /index.php endpoint with malicious SQL payloads in the Username field, an attacker can interfere with the application's database logic [1]. The exploit has been publicly released, increasing the risk of widespread scanning and active exploitation.

Impact

Successful exploitation could allow an attacker to read, modify, or delete sensitive data stored in the database. Given the nature of an online banking system, this could include financial records, user credentials, and transaction histories. The CVSS v3 score of 7.3 (High) reflects the significant potential for confidential data exposure and system compromise.

Mitigation

As of the publication date (17 November 2025), no official patched release has been provided due to the rolling-release approach. Users and administrators of the affected system are advised to implement input validation and parameterized queries for the /index.php login form, or apply any available upstream fixes. The publicly available exploit makes immediate mitigation a priority.