RUET OJ CVE-2025-12329

Q: What is the CVSS score of CVE-2025-12329?

CVE-2025-12329 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-27 cna@vuldb.com

PHP SQLi Ruet Oj Shawonruet

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:33 vuln.today

DescriptionCVE.org

A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The affected element is an unknown function of the file /details.php. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in shawon100 RUET OJ through the ID parameter of /details.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The vulnerability affects commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code released. Despite moderate CVSS 2.1, the low EPSS score of 0.02% and requirement for prior authentication significantly limit real-world exploitation likelihood.

Technical ContextAI

RUET OJ is a PHP-based online judge application. The vulnerability exists in /details.php where user-supplied input in the ID parameter is processed without sufficient sanitization or parameterized query protection, violating CWE-74 (Improper Neutralization of Special Elements in Output). The attack vector is network-based with low attack complexity, indicating straightforward SQL injection techniques apply. The product uses a rolling release model without fixed version numbers, making traditional patch tracking impossible.

RemediationAI

No vendor-released patch identified at time of analysis, as the vendor did not respond to disclosure. Immediate remediation requires upgrading to a commit after 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 if available from the project repository. Until patched, apply input validation and parameterized queries (prepared statements) to the ID parameter in /details.php to prevent SQL injection. Restrict network access to /details.php to trusted administrators only, and monitor database query logs for suspicious SQL syntax patterns. Consider disabling the vulnerable /details.php endpoint entirely if its functionality is not critical to operations.