Exam Form Submission CVE-2025-8255

The vulnerable endpoint /register.php is the public-facing user registration page, meaning no authentication is required (CVSS PR:N). No special configuration is needed beyond a standard deployment of code-projects Exam Form Submission 1.0 with network-accessible HTTP. Exploitation is fully realized only when uploaded files are stored in a web-accessible directory with PHP execution enabled - the typical default for this class of PHP educational project. Limiting factors include: the product must be actively deployed and publicly reachable; the upload directory must permit script execution (non-default hardened configurations that deny execution in upload paths would block post-upload RCE, though the upload itself would still succeed); and exploitation is scoped to version 1.0 per available CPE data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote unauthenticated exploitation - no attack complexity, no prerequisites, no user interaction. The official CVSS 4.0 score of 5.5 with VC:L/VI:L/VA:L appears conservative; it does not model the realistic RCE impact achievable when a webshell is uploaded to an executable web directory, which is the standard exploitation path for this class of vulnerability in PHP applications. The independent assessed score (see assessed_cvss_vector) reflects that realistic impact as critical. EPSS at 0.12% (30th percentile) is low, but this is attributable to the niche, low-footprint nature of the product rather than technical difficulty - the POC is publicly disclosed and the attack requires no skill. No KEV listing confirms no observed mass exploitation. The publicly available exploit code (referenced via GitHub issue) meaningfully lowers the barrier for opportunistic scanning and exploitation. Overall, any exposed deployment of this application should be treated as a high-priority remediation target despite the moderate official score.

An attacker sends a crafted HTTP POST request to the publicly accessible /register.php endpoint, submitting a PHP webshell (e.g., <?php system($_GET['cmd']); ?>) as the value of the image file upload parameter. Since the application imposes no restriction on file type, the server stores the file in a web-accessible upload directory. The attacker then issues a GET request to the uploaded file's URL with a command parameter, achieving arbitrary operating system command execution under the web server process identity. A publicly available proof-of-concept demonstrates this technique.