Projectworlds Online Admission System CVE-2025-8247

Exploitation requires authenticated access-attacker must possess valid admin credentials or session token for the Projectworlds Online Admission System (PR:L per CVSS vector). The vulnerable /admin.php file must be accessible via HTTP/HTTPS with no additional network-level restrictions. The 'markof' parameter must be processed without input validation in a SQL query context. No special configuration appears necessary; the vulnerability exists in the default code of version 1.0. Exploitation is NOT possible against unauthenticated users or in deployments where admin access is restricted to internal networks only, which are the primary limiting factors reducing real-world risk below what the 'critical' classification might suggest.

This vulnerability presents a significant classification discrepancy: the submission describes it as 'critical' but the CVSS v4.0 vector assigns it a score of 2.1 (low severity). Analysis of the vector reveals the key limiting factors: PR:L (requires authenticated login), VC:L/VI:L/VA:L (only low confidentiality, integrity, and availability impact to the vulnerable component), and no scope change. The EPSS score of 0.07% (22nd percentile) indicates very low real-world exploitation probability despite public POC availability. This pattern is consistent with a vulnerability that requires legitimate admin access to exploit-if an attacker already has admin credentials, the SQL injection becomes less critical than the underlying credential compromise. The lack of KEV status and low EPSS despite public POC suggests minimal actual exploitation in the wild. For defenders: prioritize this as medium risk only if admin accounts are at risk; if admin credentials are well-protected, this is a lower priority than the CVSS description might suggest.

An authenticated administrator or an attacker who has obtained valid admin credentials accesses the /admin.php page and manipulates the 'markof' parameter with SQL injection syntax such as 'markof=1 UNION SELECT version()--' to extract database version information, user tables, or modify records. If the admin account has been compromised through phishing or credential stuffing, the attacker can escalate privileges or exfiltrate sensitive student/admission data stored in the database without triggering alerts that might arise from more overt attacks.