Online Event Judging System CVE-2025-12263

Attacker must be an authenticated user with at least low privilege access to the Online Event Judging System 1.0 application - the PR:L (low privilege required) CVSS field confirms this. The exploit targets the /edit_judge.php endpoint and specifically the judge_id parameter. No special configuration or non-default settings are required beyond the application being deployed with its default database setup. The attack is limited to attackers who can successfully log in to the application; unauthenticated remote exploitation is not possible. Downstream impact depends on whether the application's database queries use prepared statements elsewhere (which would limit the injected SQL's practical effect) and the privilege level of the database user account (if the account lacks DELETE/UPDATE permissions, data modification attacks are blocked, but data exfiltration via UNION-based injection remains possible).

This vulnerability presents a paradoxical risk profile: the CVSS score of 2.1 and extremely low EPSS percentile (8%) suggest minimal real-world exploitation probability, yet it is confirmed as publicly exploitable (POC available) and the vulnerability class (SQL injection) is inherently dangerous. The CVSS vector explains the low score due to PR:L (authentication required), AC:L (low complexity), and limited scope impact (VC:L/VI:L/VA:L, no scope change). However, EPSS at 0.03% percentile indicates defenders and attackers alike view actual exploitation risk as very low, possibly because Online Event Judging System 1.0 has minimal real-world deployment or the authenticated-only requirement severely limits attack surface. Organizations running this software should prioritize patching on lifecycle basis rather than as an emergency, but the public POC availability means opportunistic exploitation is possible if internal attackers with low privileges exist. The actual risk depends heavily on: (1) how widely the product is deployed, (2) whether SQL queries are parameterized elsewhere (limiting injected SQL impact), and (3) database user privilege levels.

An authenticated user with low privileges (e.g., a judge account) navigates to /edit_judge.php and modifies the judge_id parameter from a legitimate value (e.g., ?judge_id=5) to a SQL injection payload (e.g., ?judge_id=5' UNION SELECT username, password FROM users--). The unvalidated input is passed directly into a SQL query, allowing the attacker to extract other judges' credentials, view event data, or modify scoring information. A public exploit on GitHub demonstrates this technique.