Online Event Judging System CVE-2025-12256

Authentication is mandatory - attacker must possess valid login credentials (low-privilege user account acceptable per PR:L in CVSS vector). The contestant_id parameter in /edit_contestant.php must accept unsanitized user input and pass it directly into SQL queries without prepared statement protection. Default or non-hardened configurations of the application are vulnerable; no unusual configuration is required. Exploitation is limited to the authenticated user context; privilege escalation is not indicated.

The risk assessment reveals a significant disconnect between technical severity and real-world exploitability. The CVSS v4.0 score of 2.1 reflects limited impact scope (L/L/L for confidentiality, integrity, availability) and mandatory authentication (PR:L), resulting in minimal severity. The EPSS score of 0.03% (8th percentile) strongly indicates this vulnerability is unlikely to be exploited in practice, placing it well below the exploitation probability threshold for active targeting. Although a public exploit exists (POC available), the authentication requirement is a critical limiting factor - the attacker must possess valid system credentials. The E:P flag (Exploit maturity: Proof-of-Concept) confirms POC availability but not active weaponization or KEV listing. This is a textbook case of high-novelty, low-impact vulnerability: publicly disclosed and PoC-available but operationally constrained by authentication prerequisites and narrow impact scope. Real-world risk is low for organizations with basic access controls.

An authenticated user (e.g., a contest judge or administrator with valid credentials) navigates to the contestant editing interface and manipulates the contestant_id parameter in the URL or POST data to inject a SQL fragment such as contestant_id=1' OR '1'='1. This causes the SQL query to execute unintended logic, potentially exfiltrating contestant data, modifying records, or determining database structure. Public exploit code is available on GitHub (https://github.com/zzonce/cve/issues/2), lowering the skill barrier for exploitation.