Exam Form Submission CVE-2025-8328

No special conditions required - /register.php is a public-facing registration endpoint accessible to unauthenticated users by design, and exploitation requires only the ability to send an HTTP POST request with a manipulated USN parameter. No authentication, session token, or privileged account is needed. The application must be network-accessible (default for any web deployment). Limiting factors: the CVSS 4.0 impact metrics VC:L/VI:L/VA:L indicate constrained database permissions that limit how much data can be read or modified; exploitation does not trivially yield remote code execution or full database compromise without additional chaining. The vendor note that 'other parameters might be affected' is unconfirmed speculation - only USN in /register.php is confirmed in available intelligence.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an attack requiring no authentication, no user interaction, and no special conditions - the simplest possible exploitation path for a network-exposed endpoint. Impact is rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), suggesting the database account used by the application has constrained permissions, limiting the practical blast radius. The reported 'critical' classification from the submitter conflicts with the 5.5 CVSS 4.0 score; the numeric score is the more defensible baseline. EPSS of 0.07% at the 20th percentile indicates mass automated exploitation is not currently observed. The publicly available POC on GitHub meaningfully lowers the skill threshold for targeted attacks. No CISA KEV listing. Real-world risk is elevated only for organizations that have deployed this specific demo application on a publicly accessible host, which is an unusual production scenario.

An unauthenticated attacker sends a crafted HTTP POST request to /register.php, injecting a SQL payload (e.g., a UNION SELECT or error-based extraction string) into the USN field. The application passes this value unsanitized into a SQL query, returning database contents or confirming injectable behavior via error messages. A public proof-of-concept is available on GitHub, meaning exploitation requires only basic HTTP tooling such as curl or Burp Suite.