Exam Form Submission CVE-2025-8372

The vulnerable endpoint is /admin/update_s7.php, which must be accessible over the network. The CVSS 4.0 vector asserts PR:N (no privileges required), meaning no authenticated session is needed - however, the /admin/ path is a weak indicator that some authentication may exist in certain deployments; this should be verified against the actual application source. No special configuration or non-default feature is required beyond the application being deployed and internet-accessible. Exploitation is limited by: (1) the product's extremely narrow real-world deployment footprint - it is a student/demo PHP project unlikely to appear in enterprise environments; (2) no active exploitation has been recorded (no KEV listing); (3) EPSS of 0.07% confirms low observed exploitation velocity. The credits parameter must be submitted to the specific endpoint - no lateral pivot into other application components is implied by available data.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, zero-complexity, unauthenticated exploitation - a high theoretical risk. However, multiple signals moderate the real-world priority: EPSS is 0.07% at the 20th percentile, placing this in the bottom quintile of exploited vulnerabilities, suggesting the security community expects minimal opportunistic exploitation. KEV status is absent, meaning no confirmed active exploitation has been recorded by CISA. The POC is public (GitHub, VulDB), so script-kiddie access exists, but the product's negligible deployment footprint drastically reduces the attack surface. The CVSS 4.0 impact metrics (VC:L/VI:L/VA:L) appear conservatively scored relative to what SQL injection typically enables (full database read/write); this discrepancy should be noted - defenders should treat actual database compromise as the realistic worst case. The /admin/ path in the endpoint raises a question about whether authentication is genuinely absent (PR:N), which the provided vector asserts but the path naming convention weakly contradicts - verification with the vendor or source review is advised.

A remote attacker identifies an internet-exposed instance of Exam Form Submission 1.0, then crafts an HTTP request to /admin/update_s7.php with a malicious value in the credits parameter (e.g., a UNION-based or boolean-blind injection payload). Using the publicly available POC on GitHub as a template, the attacker extracts database contents - including exam records, user credentials, or other stored data - without requiring prior authentication per the CVSS 4.0 vector. The low complexity and public exploit code make this accessible to low-skill threat actors targeting opportunistic victims.