Online Event Judging System CVE-2025-12255

A valid user account with authentication credentials is required to access the /add_contestant.php endpoint. The vulnerable fullname parameter is only processed when a user is authenticated and submits the contestant registration form. Default configurations likely allow this if the system is not explicitly locked down. No indication exists that the vulnerability is triggered only under specific deployment modes or non-default settings. The attack does not require elevated administrative privileges, only basic authenticated user access.

This vulnerability presents minimal real-world risk despite public exploit availability. The CVSS 4.0 vector indicates PR:L (login required), AC:L (low complexity), AV:N (network-accessible), but with very limited impact: VC:L/VI:L/VA:L (low confidentiality, integrity, and availability impact on the vulnerable system), and SC:N/SI:N/SA:N (no scope change or impact on other systems). The EPSS score of 0.03% (8th percentile) reflects this assessment-it ranks among the lowest-risk vulnerabilities despite public exploit code. The SQL injection is limited to information disclosure rather than data modification or system compromise. Exploitation requires valid authentication credentials, significantly reducing opportunistic attack likelihood. The primary risk is to organizations running this specific legacy or educational application; broader enterprise environments are unaffected. However, the public exploit availability means any authenticated attacker with system access can trivially extract sensitive data from the database without complex exploitation techniques.

An authenticated contestant or judge logs into the Online Event Judging System and navigates to the contestant registration page. They modify the fullname parameter to inject a SQL UNION statement in their browser's request, such as fullname='; UNION SELECT password FROM users -- to retrieve password hashes or sensitive user data. The injected SQL executes within the context of the legitimate database query, returning unauthorized information that appears in the application response or logs.