Exam Form Submission CVE-2025-8271

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) asserts the endpoint is reachable over the network with no authentication and no special configuration required - however, the endpoint path /admin/delete_s3.php implies an admin panel that may be protected by session-based authentication in typical deployments. The provided CVSS vector's PR:N claim should be verified: if the admin panel enforces login, exploitation would require prior credential compromise (PR:L). Exploitation is limited to installations of version 1.0 of code-projects Exam Form Submission running PHP and exposed to the network. No non-default configuration trigger is identified beyond the application being deployed and the admin endpoint being accessible. The absence of a session authentication check on the targeted file is the specific limiting - or enabling - condition that determines real-world exploitability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) places this vulnerability at maximum exploitability - network-accessible, trivial complexity, no credentials, no interaction. The limited impact metrics (VC:L/VI:L/VA:L) cap the score at 5.5 Medium, reflecting constrained database-level blast radius rather than full system compromise. EPSS at 0.09% (25th percentile) signals extremely low observed exploitation activity, consistent with the product being an obscure PHP academic project with negligible real-world deployment. A public POC exists but no KEV listing confirms active exploitation. The primary risk is to any organization that has inadvertently deployed this application and exposed the admin panel to the internet; the risk is essentially zero for environments that have never deployed code-projects Exam Form Submission. This is a low-real-world-priority issue despite its permissive attack vector, driven entirely by the product's rare deployment footprint.

An unauthenticated attacker sends a crafted GET or POST request to the exposed /admin/delete_s3.php endpoint with a SQL payload in the ID parameter (e.g., ID=1 UNION SELECT ...). The unsanitized value is interpolated directly into a SQL DELETE or SELECT query, allowing the attacker to enumerate database tables, extract credential hashes, or delete exam submission records. A working POC demonstrating this technique is publicly available at https://github.com/mynlxx/CVE-ZhuChengQing/issues/7.