Online Event Judging System CVE-2025-12252

Exploitation requires prior authentication to the Online Event Judging System 1.0; unauthenticated remote attackers cannot exploit this vulnerability. The specific condition is that the /ajax/action.php endpoint must accept the content parameter and process it within a SQL query context without parameterization or escaping. Additionally, the attacker must possess valid credentials for the application (e.g., judge, organizer, or admin account). The vulnerability is not restricted to specific event types, configurations, or deployment platforms, but exploitation is limited to the authenticated session context. Organizations using single sign-on (SSO) or requiring multi-factor authentication for event judging roles face higher barriers to exploitation than those relying on simple username/password authentication.

Multiple signals suggest this is a LOW real-world priority despite publicly available POC. EPSS score of 0.03% (8th percentile) indicates minimal exploitation probability in actual threat landscapes, contradicting the presence of public exploit code - this discrepancy suggests the POC may be proof-of-concept rather than practical attack infrastructure, or exploitation requires deployment context not widely present. CVSS vector confirms authentication is mandatory (PR:L), which significantly gates access compared to unauthenticated vectors. The limited impact scope (VC:L, VI:L, VA:L with no scope expansion) means even successful exploitation yields only partial data compromise rather than system takeover. The vulnerability is not listed in CISA KEV, further indicating no confirmed active exploitation at scale. Organizations with properly segmented environments, strong database access controls, and regular audits of user input sanitization face materially lower risk. However, development/staging instances running default configurations with test accounts should be prioritized for patching due to ease of exploitation once authenticated.

An authenticated user (e.g., event judge or administrator account) sends a crafted HTTP POST request to /ajax/action.php with a SQL injection payload embedded in the content parameter, such as content='; DROP TABLE results;--. The vulnerable code concatenates this unsanitized input directly into a SQL query, executing the attacker's injected SQL and potentially exfiltrating sensitive event judging data, modifying competition results, or corrupting the database. Attack complexity is low and requires no user interaction beyond the initial request.