Exam Form Submission
CVE-2025-8270
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated endpoint per CVSS 4.0 input (PR:N); Low impact across C/I/A reflects application-scope SQL injection without privilege escalation or scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete_s2.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation via an unsanitized ID parameter, enabling arbitrary SQL query execution against the backend database. Public exploit code has been disclosed via GitHub (CVE-ZhuChengQing/issues/6), confirming practical exploitability despite an EPSS score of 0.09% (25th percentile) that reflects the product's narrow deployment footprint rather than low technical risk. The vulnerability is not listed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
Technical ContextAI
The affected product is the PHP-based Exam Form Submission 1.0 application by code-projects (CPE: cpe:2.3:a:code-projects:exam_form_submission:1.0), a freely distributed educational and demo web application. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), with SQL injection as the specific subtype. The PHP file /admin/delete_s2.php incorporates the user-supplied ID parameter directly into a SQL query without parameterized statements or input sanitization, allowing an attacker to alter query logic at the database layer. This is a textbook unsanitized parameter injection flaw in a PHP application lacking prepared statements - a well-understood failure mode with mature exploitation tooling.
RemediationAI
No vendor-released patch has been identified at time of analysis for Exam Form Submission 1.0. The most effective fix is rewriting the SQL query in /admin/delete_s2.php to use parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), which eliminates the injection vector entirely without functional trade-offs. If immediate code modification is not possible, restricting access to the /admin/ directory via server-level authentication (HTTP Basic Auth via .htaccess or nginx auth_basic) raises the barrier for unauthenticated exploitation - note this does not fix the underlying flaw and could be bypassed if auth is weak. A WAF with SQL injection detection rules can filter malicious payloads targeting the ID parameter but may generate false positives on legitimate delete requests. Given this product's educational and demo nature, it should not be deployed in internet-facing or production environments under any circumstances. The public PoC is available at https://github.com/mynlxx/CVE-ZhuChengQing/issues/6.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today