Exam Form Submission CVE-2025-8253

Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication is required and no special configuration is needed - the /admin/delete_s6.php endpoint is exposed to the network without an enforced credential barrier in the affected version. No user interaction is required on the victim side. The primary limiting factor is deployment scope: code-projects Exam Form Submission 1.0 is an educational-grade PHP project with negligible production adoption, so internet-exposed instances are rare. Additionally, exploitation impact is bounded to the application's own database (no scope change); the database user's privilege level determines whether impact extends beyond record deletion to schema-level damage or data exfiltration. No platform-specific or OS-level prerequisites are identified.

Despite the CVSS 4.0 score of 5.5, the real-world risk profile is governed by several cross-referenced signals. The base vector (AV:N/AC:L/AT:N/PR:N/UI:N) is maximally accessible - no authentication, no complexity - which is alarming for an admin endpoint; this likely reflects that the application's admin panel itself lacks enforced authentication, a common trait in tutorial PHP projects. Impact metrics are rated Low across VC/VI/VA, which is consistent with a single-application database scope with no privilege escalation or lateral movement potential. EPSS at 0.07% (20th percentile) is low, indicating threat actors have not meaningfully targeted this in the wild. No CISA KEV listing further supports low active exploitation. A public PoC exists on GitHub, which lowers the bar for casual exploitation but does not indicate automated or widespread campaign activity. The dominant risk-reduction factor is obscurity: this is a hobbyist PHP project with negligible enterprise footprint. For any organization actually running this software, the unauthenticated remote SQL injection on an admin deletion endpoint represents a credible, high-priority issue.

An unauthenticated remote attacker sends a crafted HTTP request to /admin/delete_s6.php?ID=1+OR+1%3D1-- (or a POST equivalent), injecting SQL logic that bypasses the intended single-record deletion and triggers broader database operations such as full table enumeration or mass deletion. A public PoC demonstrating this technique is available at https://github.com/mynlxx/CVE-ZhuChengQing/issues/10. Depending on the database user's privileges, the attacker could also pivot to reading sensitive exam or user data stored in the application's backend.