Exam Form Submission CVE-2025-8371

The vulnerable parameter is credits in the file /admin/update_s5.php. The CVSS 4.0 vector assigns PR:N (no privileges required), implying the endpoint is reachable without authentication - however, the /admin/ path prefix is a notable tension point: if the application enforces session-based login before reaching this page, exploitation would require valid admin credentials (limiting real-world risk). Defenders should verify whether their deployment exposes /admin/update_s5.php to unauthenticated HTTP requests. No special platform, configuration, or non-default feature flag is described as a prerequisite beyond running the application. Exploitation is limited to version 1.0 of this specific product; no other versions or platforms are confirmed affected.

The CVSS 4.0 base score of 5.5 (Medium) reflects limited confidentiality, integrity, and availability impact at the vulnerable-system level with no subsequent-system impact. The EPSS score of 0.07% (20th percentile) is notably low, indicating that exploitation in the wild is rare or unlikely despite the POC being public - consistent with the product's obscure deployment footprint. No CISA KEV listing exists, so active exploitation is not confirmed. The PR:N vector assignment warrants scrutiny: the vulnerable endpoint is under /admin/, which conventionally implies authenticated access; if the admin panel is protected by session-based authentication not captured in the CVSS assessment, real-world exploitability would be lower than the vector suggests - defenders should verify whether unauthenticated access to this endpoint is actually possible in their deployment. The combination of a low-footprint product, low EPSS, no KEV, and an admin-path endpoint makes this a low operational priority for most organizations.

An attacker sends a crafted HTTP POST or GET request to /admin/update_s5.php on a publicly accessible Exam Form Submission 1.0 installation, injecting SQL syntax into the credits parameter (e.g., a UNION-based payload). If the admin panel lacks authentication enforcement, no prior access is needed; the injected query executes with the database user's privileges, potentially enabling extraction of all stored data or modification of records. A proof-of-concept demonstrating this technique is publicly available at the referenced GitHub issue.