Is there a public PoC exploit available for CVE-2025-8326?

Yes, a public proof-of-concept exploit is available for CVE-2025-8326. Prioritise patching immediately. EPSS: 0.1%.

Exam Form Submission CVE-2025-8326

Q: What is the CVSS score of CVE-2025-8326?

CVE-2025-8326 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-30 cna@vuldb.com

PHP SQLi Exam Form Submission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-reachable SQLi with no authentication per provided vector; scope unchanged and impact partial across all three CIA dimensions consistent with CVSS 4.0 VC:L/VI:L/VA:L metrics.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:46 vuln.today

CVE Published

Jul 30, 2025 - 13:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/delete_s7.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s7.php endpoint to remote database manipulation through an unsanitized ID parameter, enabling unauthenticated attackers to read, modify, or delete backend database content. The CVSS 4.0 vector confirms no authentication and no user interaction are required, making this trivially exploitable from the network; a public proof-of-concept has been disclosed on GitHub at https://github.com/vullis0/cve/issues/1. Despite accessible attack conditions, an EPSS score of 0.07% (20th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, likely reflecting the product's extremely limited deployment footprint.

Technical ContextAI

The affected product is code-projects Exam Form Submission version 1.0 (CPE: cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*), a PHP-based web application distributed via code-projects.org for managing student exam form submissions. The vulnerability resides in /admin/delete_s7.php, where the ID parameter is dynamically interpolated into a SQL query without parameterization or input sanitization. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection) is the assigned root-cause class, with this specific instance being a classic SQL injection (CWE-89 subcategory). The PHP application constructs SQL directly from user input, a pattern common in tutorial-grade or educational PHP projects that omit prepared statements, allowing SQL metacharacters to alter query logic and interact with the underlying database engine.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the references point only to the code-projects.org homepage and the public exploit disclosure, with no upstream patch or security advisory available. As an immediate compensating control, access to /admin/delete_s7.php and the entire /admin/ path should be restricted at the web server or firewall level to trusted IP addresses only; this directly limits the network-accessible attack surface but may inconvenience remote administrators. Deploying a WAF rule blocking SQL metacharacters (single quotes, comment sequences, UNION/SELECT keywords) in the ID parameter provides an additional layer, though WAF bypass is achievable by skilled attackers. The definitive fix requires modifying the PHP source of /admin/delete_s7.php to use PDO or MySQLi prepared statements with bound parameters, replacing any dynamic SQL string construction. Monitor the public exploit thread at https://github.com/vullis0/cve/issues/1 and VulDB entry https://vuldb.com/?id.318276 for vendor patch announcements.