Online Event Judging System CVE-2025-12254

Authentication is required: attacker must possess valid credentials with access to the judge-creation functionality (PR:L in CVSS vector). The /add_judge.php endpoint must be accessible and not restricted by network or application-level controls. The fullname parameter must be processed directly in a SQL query without parameterized query protection. The application must be running code-projects Online Event Judging System version 1.0 specifically; no information about whether other versions are affected is available. The SQL injection impact is limited to data extraction with low confidentiality impact; no privilege escalation, authentication bypass, or direct system compromise is possible per CVSS scope limitations (SC:N, SI:N, SA:N).

This vulnerability presents unusually low real-world risk despite matching typical SQL injection patterns. The CVSS 4.0 score of 2.1 is driven by the mandatory authentication requirement (PR:L) and limited impact scope (VC:L, VI:L, VA:L, SC:N, SI:N, SA:N), which restricts the attacker to reading data with low confidentiality consequences. The EPSS score of 0.03% (8th percentile) is extraordinarily low, suggesting minimal exploitation probability in practice. While publicly available exploit code exists, the combination of authentication requirement, low impact scope, and negligible EPSS percentile indicates this is a low-priority vulnerability affecting primarily organizations running code-projects Online Event Judging System 1.0 where threat actors have already compromised user accounts. The disparity between public POC availability and near-zero EPSS suggests the exploit requires specific configuration, valid credentials with judge-creation privileges, or has limited utility beyond proof-of-concept demonstrations. No evidence of active exploitation in CISA KEV or reliable sources was provided.

An attacker with a valid user account (obtained through credential compromise, phishing, or insider threat) logs into the Online Event Judging System and navigates to the judge-creation interface. The attacker enters a SQL injection payload such as ' OR '1'='1 in the fullname parameter and submits the form to /add_judge.php. The unsanitized input is concatenated directly into the SQL query, allowing the attacker to manipulate the query logic and extract sensitive data (e.g., admin usernames, email addresses, other judges' information) from the database.