Is there a public PoC exploit available for CVE-2025-8272?

Yes, a public proof-of-concept exploit is available for CVE-2025-8272. Prioritise patching immediately. EPSS: 0.1%.

Exam Form Submission CVE-2025-8272

Q: What is the CVSS score of CVE-2025-8272?

CVE-2025-8272 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-28 cna@vuldb.com

PHP SQLi Exam Form Submission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Admin-path endpoint likely requires credentials (PR:L); straightforward SQLi with partial DB read, write, and availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:47 vuln.today

CVE Published

Jul 28, 2025 - 11:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/update_fst.php. The manipulation of the argument credits leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write operations via the unsanitized credits parameter in /admin/update_fst.php. A publicly available proof-of-concept on GitHub (referenced in NVD) documents the exact injection point, lowering the bar for opportunistic attacks against any internet-exposed instance. Despite a moderate CVSS 4.0 score of 5.5 and a low EPSS of 0.09% (25th percentile), the combination of a network-accessible vector, no complexity barriers, and public exploit code makes this actionable for any deployment - no public exploit identified as confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists.

Technical ContextAI

The affected product is a PHP-based web application (cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*) distributed by code-projects.org, a repository of educational/hobbyist PHP scripts. The vulnerable file /admin/update_fst.php handles updates to form submission records and incorporates the user-supplied credits parameter directly into a SQL query without sanitization or parameterization. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - the parent class of CWE-89 SQL Injection), indicating the application fails to neutralize SQL metacharacters before passing the input to the database engine. This class of flaw arises from direct string concatenation in query construction rather than use of prepared statements or PDO with bound parameters, which is common in legacy or educational PHP codebases.

RemediationAI

No vendor-released patch identified at time of analysis - code-projects.org does not operate a formal security advisory or patch release process for this script. The primary fix is to rewrite the SQL query in /admin/update_fst.php to use PHP PDO or MySQLi prepared statements with bound parameters, entirely eliminating the injection surface. As an immediate compensating control, restrict access to the /admin/ directory at the web server level (Apache .htaccess or nginx location block) to trusted IP ranges only - this is actionable and has no functional side effects for legitimate admin users on a controlled network. Additionally, enforce strict numeric input validation on the credits parameter (reject non-integer values before query execution) as a secondary defense. Removing the /admin/ interface from public internet exposure is the single highest-impact mitigation if a code fix cannot be applied immediately. References: https://vuldb.com/?id.317861, https://github.com/mynlxx/CVE-ZhuChengQing/issues/4.