Exam Form Submission CVE-2025-8273

The attack targets the credits parameter in the PHP file /admin/update_s8.php. The official CVSS 4.0 vector assigns PR:N and UI:N, indicating the reporter assessed no authentication or user interaction as required. However, the /admin/ path prefix implies this endpoint may be protected by an admin login - whether the application actually enforces this session check is not confirmed by the available data and should be verified by reviewing the source. No special network positioning is required beyond HTTP access to the web server. There is no indication that non-default configuration is needed; the vulnerability appears to exist in default deployments of version 1.0. The primary limiting factor is the extremely narrow real-world deployment footprint of this educational PHP project.

The CVSS 4.0 score of 5.5 (Medium) reflects limited per-component impact (VC:L/VI:L/VA:L) and no scope change, which is consistent with a standard SQL injection in a narrow application context. The EPSS score of 0.09% at the 25th percentile strongly suggests that despite the public POC, this vulnerability is not being actively exploited in the wild - this is typical for obscure, low-deployment PHP educational projects. No CISA KEV listing exists. The primary risk amplifier is the public POC, which lowers the skill bar for exploitation. However, the minimal real-world deployment footprint of code-projects Exam Form Submission dramatically limits blast radius. A notable tension exists in the data: the CVSS vector assigns PR:N (no authentication required), yet the vulnerable file resides at /admin/update_s8.php, an admin-prefixed path. If the application enforces any form of admin session check, the effective PR would be PR:L or PR:H - this should be independently verified by inspecting the application's authentication logic.

An attacker sends a crafted HTTP POST or GET request to /admin/update_s8.php with a manipulated credits parameter containing SQL metacharacters or UNION-based payloads. The unsanitized input is passed directly into a database query, allowing the attacker to enumerate tables, extract credential hashes, or modify records. A public proof-of-concept is available at https://github.com/mynlxx/CVE-ZhuChengQing/issues/3, further lowering exploitation complexity.