Online Event Judging System CVE-2025-12255

Apply vendor updates or patches if available from code-projects or the Carmelo development team. If patched versions are unavailable, implement immediate compensating controls: enforce parameterized prepared statements or prepared queries in the /add_contestant.php file's database interaction code, validate and whitelist the fullname parameter to permit only alphanumeric characters and common punctuation (spaces, hyphens, apostrophes), implement database-level least-privilege access so the application's database user lacks write permissions beyond the contestant table, and deploy a Web Application Firewall (WAF) rule to block requests containing SQL keywords (UNION, SELECT, OR, etc.) in the fullname parameter. Consider disabling or restricting access to the contestant management feature via network access controls or authentication tokens if the application is not actively used. Organizations should coordinate patching with functional testing, as WAF rules may block legitimate names containing special characters.