Is there a public PoC exploit available for CVE-2025-8269?

Yes, a public proof-of-concept exploit is available for CVE-2025-8269. Prioritise patching immediately. EPSS: 0.1%.

Exam Form Submission CVE-2025-8269

Q: What is the CVSS score of CVE-2025-8269?

CVE-2025-8269 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-28 cna@vuldb.com

PHP SQLi Exam Form Submission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible SQL injection with no confirmed auth requirement per submitted vector; limited impact scoped to application database with no privilege escalation or scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:48 vuln.today

CVE Published

Jul 28, 2025 - 09:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s1.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database manipulation via an unsanitized ID parameter. The vulnerability (CWE-74, Injection) allows a remote attacker to craft malicious HTTP requests that alter the intended SQL query, potentially reading, modifying, or deleting records in the underlying database. A public proof-of-concept has been disclosed on GitHub; however, EPSS stands at just 0.09% (25th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis.

Technical ContextAI

The affected product is a PHP-based academic exam form submission application from code-projects, precisely identified by CPE cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which is the parent class for SQL injection (CWE-89). The specific sink is the ID parameter passed to /admin/delete_s1.php, which is interpolated directly into a SQL DELETE (or similar) statement without parameterization or sanitization. This is a classic first-generation PHP anti-pattern where user-supplied input is concatenated into raw SQL queries. The /admin/ path prefix suggests the endpoint is intended to be part of an administrative interface, raising questions about whether authentication is enforced - an issue the submitted CVSS PR:N metric does not clarify definitively.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary remediation is to replace dynamic SQL string concatenation in /admin/delete_s1.php with parameterized queries or prepared statements (e.g., PDO or MySQLi with bound parameters), which eliminates the injection vector entirely. As a compensating control, access to the /admin/ directory should be restricted via web server configuration (e.g., IP allowlisting or HTTP authentication at the server level) to limit exposure; this does not fix the underlying flaw but meaningfully reduces attack surface. Input validation on the ID parameter (enforce integer type) provides defense-in-depth but should not be relied upon as the sole control. Given this is a code-projects educational application, organizations should evaluate whether it should be internet-accessible at all. References: POC at https://github.com/mynlxx/CVE-ZhuChengQing/issues/5, VulDB entry at https://vuldb.com/?ctiid.317858.