Exam Form Submission CVE-2025-8270

The CVSS 4.0 PR:N metric indicates no authentication is required to reach the vulnerable /admin/delete_s2.php endpoint, implying the admin panel is accessible without login - consistent with code-projects demo software that typically ships without access controls but not independently verified against vendor documentation. The application must be deployed and reachable over the network (internet or internal). No special configuration, feature flag, or non-default setting is required beyond a standard installation of version 1.0. Exploitation is bounded by the product's very limited deployment footprint: it is educational software with negligible production use. Additionally, the Low impact ratings (VC:L/VI:L/VA:L) cap the blast radius to the application's local database rather than broader host or infrastructure compromise.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the vulnerability is network-exploitable with no authentication, no special attack conditions, and no user interaction required - all characteristics associated with high exploitability. However, impact is uniformly Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no subsequent-system impact, producing an overall score of 5.5 (medium). The E:P supplemental metric confirms public exploit availability, elevating practical risk above what the base score alone implies. EPSS at 0.09% (25th percentile) indicates low automated exploitation probability, consistent with a niche educational product rather than widely-deployed enterprise software - the EPSS signal here reflects deployment scarcity, not difficulty of exploitation. The vulnerability is not in CISA KEV. A notable tension exists: the endpoint path /admin/delete_s2.php suggests an admin-facing function, yet PR:N in the CVSS indicates no authentication is required - this implies the admin area is unauthenticated, a pattern common in code-projects demo software but not independently confirmed by vendor documentation.

An attacker discovers a publicly exposed Exam Form Submission 1.0 instance and submits a crafted HTTP request to /admin/delete_s2.php with a manipulated ID parameter containing a SQL injection payload (e.g., ID=1 UNION SELECT...) to extract database contents or subvert delete logic. Because a working public PoC has been disclosed on GitHub, exploitation requires minimal skill and can be replicated directly from the published issue.