Online Event Judging System CVE-2025-12254

Immediate action requires upgrading to a patched version if available from the vendor; however, no vendor-released patch version has been identified in available data. Contact code-projects directly via https://code-projects.org/ to request a security update for version 1.0. As a compensating control pending vendor remediation, restrict access to /add_judge.php to only trusted administrative IP addresses via firewall or reverse proxy rules. Implement parameterized queries (prepared statements) in the add_judge.php handler for all user input, particularly the fullname parameter, ensuring SQL syntax cannot be injected. Enforce principle of least privilege by limiting user accounts to the minimum database permissions required and removing judge-creation privileges from standard user roles. Validate and sanitize the fullname parameter on the server side using a whitelist of allowed characters (alphanumeric, spaces, hyphens only). Apply Web Application Firewall (WAF) rules to detect and block common SQL injection payloads in the fullname parameter. These controls should significantly reduce exploitation likelihood while a permanent vendor patch is pursued.