Online Event Judging System CVE-2025-12262

Exploitation requires authentication to the Online Event Judging System (PR:L in CVSS vector). The attacker must possess valid user credentials and an active session. The /edit_criteria.php endpoint must be accessible to authenticated users. The vulnerability is specifically in manipulation of the crit_id parameter, implying the endpoint accepts this parameter and processes it in SQL queries without proper parameterization. Default installations of version 1.0 appear vulnerable based on the CPE specification with no evidence of built-in protections or mitigations.

Multiple data points create a complex risk picture. The CVSS 4.0 vector shows network accessibility (AV:N) with low privilege requirements (PR:L), making it theoretically exploitable by authenticated users. However, the EPSS percentile of 8% (0.03% probability) strongly suggests this vulnerability is not being actively exploited in the wild despite public POC availability. The low impact ratings (VC:L/VI:L/VA:L) indicate the SQL injection cannot escalate to full system compromise or data exfiltration. The authentication requirement (PR:L) substantially reduces real-world risk compared to unauthenticated SQL injection flaws. The presence of public exploit code without corresponding CISA KEV listing or widespread exploitation reports indicates this is a low-priority vulnerability affecting a niche product with limited deployment.

An authenticated user with event judging privileges logs into the Online Event Judging System and modifies the crit_id parameter in a request to /edit_criteria.php from a legitimate criteria ID to a SQL injection payload such as '1 OR 1=1--', allowing them to retrieve or modify criteria data outside their authorization scope. The exploitation requires valid session credentials but can be executed through a standard web browser.