Is there a public PoC exploit available for CVE-2025-8271?

Yes, a public proof-of-concept exploit is available for CVE-2025-8271. Prioritise patching immediately. EPSS: 0.1%.

Exam Form Submission CVE-2025-8271

Q: What is the CVSS score of CVE-2025-8271?

CVE-2025-8271 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-28 cna@vuldb.com

PHP SQLi Exam Form Submission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible SQLi with no confirmed auth requirement; limited C/I/A impact scoped to database records, no scope change beyond the application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:47 vuln.today

CVE Published

Jul 28, 2025 - 10:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete_s3.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s3.php endpoint to remote manipulation via an unsanitized ID parameter, enabling attackers to read, alter, or destroy database records. The CVSS 4.0 base vector confirms no authentication or user interaction is required (PR:N/UI:N/AV:N), though the endpoint's placement under /admin/ raises questions about whether real-world deployments enforce access controls. A public proof-of-concept has been disclosed on GitHub; exploitation is not confirmed in CISA KEV and EPSS sits at a low 0.09%, consistent with the product's negligible enterprise footprint.

Technical ContextAI

The affected product is a PHP-based web application - code-projects Exam Form Submission version 1.0 - identified by CPE cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), the parent class covering injection flaws, manifesting as SQL injection. The ID parameter in the PHP script /admin/delete_s3.php is concatenated into a SQL query without parameterization or sanitization, allowing arbitrary SQL statement injection. This is a classic first-order SQLi pattern common in hobbyist and academic PHP projects that do not use prepared statements or an ORM.

RemediationAI

No vendor-released patch has been identified at time of analysis. Operators should immediately restrict access to /admin/delete_s3.php using web-server-level controls - for Apache, apply an <Files> or <Location> directive to require IP allowlisting or HTTP basic authentication; for nginx, use allow/deny directives or auth_basic. Trade-off: these controls must be maintained as IPs change. If the delete-student functionality is not needed, remove or disable the file entirely. For code-level remediation, replace dynamic SQL string concatenation with PHP PDO prepared statements and parameterized queries on the ID input. Monitor https://vuldb.com/?id.317860 and https://vuldb.com/?ctiid.317860 for any upstream patch releases.