Is there a public PoC exploit available for CVE-2025-8372?

Yes, a public proof-of-concept exploit is available for CVE-2025-8372. Prioritise patching immediately. EPSS: 0.1%.

Exam Form Submission CVE-2025-8372

Q: What is the CVSS score of CVE-2025-8372?

CVE-2025-8372 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-31 cna@vuldb.com

PHP SQLi Exam Form Submission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Network-reachable SQLi with PR:N per CVSS 4.0 vector; full database read/write justifies C:H and I:H; availability impact partial.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:40 vuln.today

CVE Published

Jul 31, 2025 - 08:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/update_s7.php. The manipulation of the argument credits leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation through the credits parameter of /admin/update_s7.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for exploitation. Despite a network-accessible attack vector with no confirmed authentication barrier, real-world risk is constrained by the product's extremely limited deployment footprint - it is a PHP academic demo project with negligible enterprise presence.

Technical ContextAI

The affected product is a PHP-based web application (CPE: cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*) published by code-projects, a provider of open-source academic demo software. The vulnerability is classified under CWE-74 (Injection), with the SQL injection root cause arising from unsanitized user-supplied input passed directly into a database query within /admin/update_s7.php. The credits parameter is not validated or parameterized before being embedded in SQL, allowing an attacker to alter query structure. This is a classic first-order SQL injection pattern common in legacy PHP applications that lack prepared statements or an ORM layer.

RemediationAI

No vendor-released patch has been identified at time of analysis - there is no tagged release or security advisory from code-projects addressing this CVE. The upstream POC and report are tracked at https://github.com/mynlxx/CVE-ZhuChengQing/issues/2 and https://vuldb.com/?submit.622556. Operators running this software should immediately apply input parameterization to the credits parameter in /admin/update_s7.php using PHP PDO prepared statements or MySQLi parameterized queries, which eliminates the injection surface. As a compensating control, restrict access to the /admin/ directory at the web server or firewall level to trusted IP ranges only - this reduces the attack surface to network-adjacent trusted hosts and is the most actionable immediate step. Given the product's academic nature, replacing it with a maintained alternative is the most durable remediation path.