Is there a public PoC exploit available for CVE-2025-8253?

Yes, a public proof-of-concept exploit is available for CVE-2025-8253. Prioritise patching immediately. EPSS: 0.1%.

Exam Form Submission CVE-2025-8253

Q: What is the CVSS score of CVE-2025-8253?

CVE-2025-8253 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-28 cna@vuldb.com

PHP SQLi Exam Form Submission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable endpoint with no confirmed auth barrier; SQL injection yields limited read/write/delete impact scoped to the application database only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:21 vuln.today

CVE Published

Jul 28, 2025 - 03:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete_s6.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s6.php endpoint to remote unauthenticated attackers who can manipulate the ID parameter to execute arbitrary SQL against the application's database. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication barrier and no complexity hurdle, making exploitation straightforward for any internet-reachable deployment. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS sits at just 0.07% (20th percentile) and no CISA KEV listing exists, reflecting the product's extremely limited real-world deployment footprint.

Technical ContextAI

The affected product is a PHP-based web application - code-projects Exam Form Submission 1.0 (CPE: cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*) - a lightweight, educational-grade form management tool. The vulnerable file /admin/delete_s6.php handles deletion of student or exam records by a user-supplied ID parameter. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection): the ID value is concatenated directly into a SQL statement without parameterization or sanitization, a classic PHP anti-pattern common in hobbyist and tutorial-grade code. This allows an attacker to alter the SQL query's logic, extract data, modify records, or trigger deletion beyond intended scope.

RemediationAI

No vendor-released patch has been identified at time of analysis. As an immediate compensating control, restrict network access to the /admin/ directory to trusted IP addresses only, using web server directives (e.g., Apache Require ip 192.168.x.x or nginx allow/deny blocks) - this reduces remote attack surface but does not fix the underlying flaw. The permanent fix requires rewriting the SQL query in /admin/delete_s6.php to use parameterized queries or prepared statements (e.g., PHP PDO with bindParam), replacing any string concatenation of the ID value. As an interim layer, add server-side input validation enforcing that ID accepts only positive integers, rejecting any non-numeric input - this is low-risk and blocks the most common injection vectors without side effects. A WAF rule blocking SQL metacharacters (', --, UNION SELECT, etc.) in the ID parameter can provide defense-in-depth. Reference the public PoC at https://github.com/mynlxx/CVE-ZhuChengQing/issues/10 and VulDB entry https://vuldb.com/?id.317841 for reproduction context.