RUET OJ CVE-2025-12327

The vendor (shawonruet) did not respond to early disclosure notifications and has not released an official patch as of the analysis date. Administrators should monitor the RUET OJ GitHub repository for security fixes and apply updates as soon as available. As an immediate compensating control, restrict access to the /description.php endpoint to authenticated users and apply a Web Application Firewall (WAF) rule to block common SQL injection payloads in the ID parameter (e.g., patterns containing single quotes, semicolons, or SQL keywords). Additionally, implement database-level read-only permissions for the application user account if the application does not require write access to the affected query - this limits the scope of injected commands to SELECT operations only. Developers should conduct an immediate code review of all user-input handling in PHP files, particularly those processing ID or identifier parameters, and refactor them to use prepared statements with parameterized queries. For long-term mitigation, consider migrating to a PHP framework with built-in ORM and input validation (e.g., Laravel, Symfony) that enforces prepared statements by default.