Exam Form Submission CVE-2025-8327

Exploitation requires network access to a running instance of code-projects Exam Form Submission 1.0. The specific vulnerable endpoint is /admin/delete_s8.php, and the ID parameter must be attacker-controllable via an HTTP request. The CVSS 4.0 vector assigns PR:N (no privileges required), suggesting the admin panel either lacks authentication or can be accessed without valid credentials - however, this is not independently verified from source code review and constitutes a potential conflict with the /admin/ path convention. No special configuration beyond a default installation appears required per available data. Exploitation is limited to this specific version (1.0) of this specific educational PHP application; no other products or versions are referenced. The low CIA impact ratings (VC:L/VI:L/VA:L) indicate the database access gained is partial, not full administrative database control.

The vendor-assigned CVSS 4.0 score is 5.5 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, indicating a remotely exploitable, low-complexity flaw with no authentication required and low impact across all CIA dimensions. Notably, the endpoint resides under /admin/, which typically implies some form of session-based authentication - the PR:N assignment may indicate the admin panel lacks proper access controls or that authentication is trivially bypassed, but this is not independently confirmed from available data. EPSS at 0.07% places exploitation probability in the 20th percentile, consistent with a niche, low-footprint product attracting minimal adversarial attention despite POC availability. The vulnerability is not listed in CISA KEV. The overall real-world risk is low: the affected product is an educational/demo application with negligible enterprise deployment, the CIA impact metrics are all rated Low, and there is no evidence of active in-the-wild exploitation.

An attacker identifies a publicly accessible instance of Exam Form Submission 1.0 and navigates to /admin/delete_s8.php, appending a crafted SQL payload to the ID parameter (e.g., ?ID=1 OR 1=1). If the admin panel lacks authentication controls (consistent with PR:N in the CVSS vector), the attacker can enumerate, extract, or delete records from the underlying database without credentials. A public POC documenting this technique is available on GitHub at https://github.com/18672919390/CVE/issues/1.