Exam Form Submission
CVE-2025-8327
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Admin path implies some credential barrier (PR:L); low partial CIA impact reflects limited scope of SQL injection in a small-footprint app.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s8.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s8.php endpoint to remote exploitation via a manipulated ID parameter. The unsanitized input is passed directly into a SQL query, enabling an attacker to read, modify, or delete database records. A public proof-of-concept has been disclosed on GitHub; however, EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate no widespread automated exploitation has been observed at time of analysis.
Technical ContextAI
The affected product is a PHP-based academic web application from code-projects.org, identified by CPE cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*. The root cause class is CWE-74 (Injection), the parent category encompassing SQL injection: user-supplied input (the ID parameter in a DELETE-type admin action) is incorporated into a downstream SQL query without sanitization or parameterized query use. The /admin/delete_s8.php file is part of an administrative interface for managing exam form submission records. The use of direct string interpolation into SQL in PHP without prepared statements is a classic pattern in educational or prototype code-project repositories, making this a textbook unsanitized-parameter SQL injection.
RemediationAI
No vendor-released patch or updated version has been identified at time of analysis - the code-projects.org product page does not reference a fixed release. The primary remediation is to replace direct string interpolation in the SQL query within /admin/delete_s8.php with a parameterized prepared statement (PDO or MySQLi with bound parameters in PHP), which eliminates the injection vector entirely. As a compensating control, restrict access to the /admin/ directory via server-level authentication (e.g., HTTP Basic Auth enforced in .htaccess or web server config) to reduce the attack surface if a network block is not feasible - note this does not fix the underlying flaw but raises the bar for exploitation. Additionally, apply a Web Application Firewall (WAF) rule to block SQL metacharacters in the ID parameter as a short-term measure, accepting that WAF bypass techniques may circumvent this. Given this is an educational project, the most appropriate action for any production-adjacent deployment is to remove or take offline the affected application entirely. Reference: https://github.com/18672919390/CVE/issues/1 for POC context; https://vuldb.com/?ctiid.318277 for VulDB advisory.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today