Exam Form Submission CVE-2025-8272

The CVSS 4.0 vector assigns PR:N, indicating no authentication is required per the scoring; however, the vulnerable endpoint is located at /admin/update_fst.php, a path that commonly implies an application-level login gate - this discrepancy is unresolved in available data and must be verified against the running application. Exploitation requires a network-accessible deployment of Exam Form Submission 1.0 with the /admin/update_fst.php script reachable by the attacker. No non-default configuration is required - the injection exists in the default codebase. Factors limiting exploitation include: the extremely small deployment footprint of this educational PHP script (reducing the exposed attack surface globally), the partial impact ceiling (VC:L/VI:L/VA:L - not full database control), and the possibility that admin-path authentication blocks unauthenticated access despite PR:N CVSS scoring. No special platform, OS, or database engine variant is specified as a prerequisite.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) signals the highest-risk surface conditions: network-accessible, low complexity, no prerequisites, no user interaction. However, several signals temper the urgency. First, EPSS is 0.09% at the 25th percentile - extremely low - indicating limited attacker interest or tooling investment targeting this specific application. Second, the application is not in CISA KEV, confirming no confirmed active exploitation campaign at time of analysis. Third, the impact ceiling is partial (VC:L/VI:L/VA:L in CVSS 4.0), meaning full database takeover or remote code execution is not directly indicated by available data. A notable inconsistency exists: the CVSS 4.0 vector assigns PR:N (no authentication), yet the vulnerable file resides under the /admin/ path, which commonly implies an application-level login requirement. If the admin interface is in fact authenticated, the real-world risk drops significantly compared to a raw PR:N reading. This discrepancy should be verified against the application's actual access controls. The publicly available POC on GitHub is the primary risk amplifier - it eliminates the need for attacker research and enables script-kiddie exploitation.

An attacker identifies an internet-accessible deployment of Exam Form Submission 1.0 and sends a crafted HTTP request to /admin/update_fst.php with a SQL injection payload embedded in the credits parameter, such as a UNION-based or error-based injection string. Using the publicly available POC documented on GitHub (issue #4 in the CVE-ZhuChengQing repository), the attacker can enumerate database tables, extract credentials or sensitive form data, or modify database records with minimal SQL knowledge. Whether a login prompt precedes this endpoint is the primary variable determining ease of exploitation.