Exam Form Submission CVE-2025-8326

The /admin/delete_s7.php file must be network-accessible from the attacker's location - if the /admin/ path is shielded behind authentication middleware, a reverse proxy, or network-level access controls, this attack is blocked before the vulnerable code is reached. The CVSS 4.0 vector specifies PR:N (no privileges required), indicating the admin endpoint either lacks authentication enforcement in the default deployment or that authentication bypass is feasible; however, the CVE description does not explicitly confirm the auth posture, so this should be verified against the actual application. No special configuration, feature flag, or non-default setting is described as prerequisite - a default installation of version 1.0 with the endpoint reachable is sufficient. Exploitation is strictly limited to this single endpoint and parameter; no lateral movement or scope change to other systems is indicated by available data. Deployments that enforce authentication on /admin/ paths or restrict access by IP are substantially protected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) represents worst-case access conditions: the vulnerability is network-reachable, requires no special attack prerequisites, no authentication, and no user interaction - making exploitation straightforward for any attacker who can reach the endpoint. The E:P modifier in the provided vector explicitly confirms a public exploit exists. However, the impact metrics (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N) are limited, reflecting partial rather than full database compromise and no scope change to other systems, yielding an overall score of 5.5. The EPSS score of 0.07% (20th percentile) is notably low given the public POC, which strongly suggests the product has minimal production deployment and is not being actively targeted in the wild. This is not a high-CVSS-but-low-risk case from a technical standpoint - exploitation is genuinely easy - but real-world risk is constrained almost entirely by the obscurity and limited footprint of the product. No CISA KEV listing means no confirmed active exploitation. The gap between easy exploitability and low EPSS is consistent with this being an educational or demo application rarely deployed in enterprise environments.

An attacker with network access to the application sends a crafted HTTP request to /admin/delete_s7.php?ID=1' OR 1=1-- (or equivalent payload), causing the PHP backend to execute attacker-controlled SQL against the database and return or alter records beyond the intended single deletion. A working proof-of-concept is publicly available at https://github.com/vullis0/cve/issues/1, meaning exploitation requires no advanced skill - the attacker need only adapt the disclosed template. Depending on the database user's privileges, the attacker may enumerate exam submission records, extract credentials stored in the database, or corrupt/delete all submission data.