Ruet Oj
Monthly
SQL injection in shawon100 RUET OJ through the ID parameter of /details.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The vulnerability affects commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code released. Despite moderate CVSS 2.1, the low EPSS score of 0.02% and requirement for prior authentication significantly limit real-world exploitation likelihood.
SQL injection in RUET OJ via the Name parameter in /contestproblem.php allows authenticated remote attackers to execute arbitrary SQL queries with limited impact on confidentiality and integrity. The vulnerability affects the rolling-release codebase up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, requires valid login credentials to exploit, and carries a very low CVSS score (2.1) despite publicly available exploit code, indicating minimal real-world risk due to authentication barriers and constrained database access.
SQL injection in RUET OJ /description.php endpoint allows authenticated remote attackers to manipulate the ID parameter and inject arbitrary SQL commands, achieving limited confidentiality and integrity compromise. The vulnerability affects the rolling-release version up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code disclosed. Despite the public disclosure, the extremely low EPSS score (0.02%) and high authentication barrier suggest minimal real-world exploitation risk, though the unresponsive vendor posture leaves the codebase unpatched.
SQL injection in RUET OJ's /process.php POST request handler allows remote unauthenticated attackers to manipulate the 'un' parameter to interact with the underlying database. The affected codebase, maintained by shawon100 on GitHub, uses no formal versioning - all commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 are affected. A public exploit has been disclosed via VulDB, though the EPSS score of 0.02% (6th percentile) reflects the product's extremely limited deployment footprint; no active exploitation is confirmed.
SQL injection in shawon100 RUET OJ through the ID parameter of /details.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The vulnerability affects commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code released. Despite moderate CVSS 2.1, the low EPSS score of 0.02% and requirement for prior authentication significantly limit real-world exploitation likelihood.
SQL injection in RUET OJ via the Name parameter in /contestproblem.php allows authenticated remote attackers to execute arbitrary SQL queries with limited impact on confidentiality and integrity. The vulnerability affects the rolling-release codebase up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, requires valid login credentials to exploit, and carries a very low CVSS score (2.1) despite publicly available exploit code, indicating minimal real-world risk due to authentication barriers and constrained database access.
SQL injection in RUET OJ /description.php endpoint allows authenticated remote attackers to manipulate the ID parameter and inject arbitrary SQL commands, achieving limited confidentiality and integrity compromise. The vulnerability affects the rolling-release version up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, with publicly available exploit code disclosed. Despite the public disclosure, the extremely low EPSS score (0.02%) and high authentication barrier suggest minimal real-world exploitation risk, though the unresponsive vendor posture leaves the codebase unpatched.
SQL injection in RUET OJ's /process.php POST request handler allows remote unauthenticated attackers to manipulate the 'un' parameter to interact with the underlying database. The affected codebase, maintained by shawon100 on GitHub, uses no formal versioning - all commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 are affected. A public exploit has been disclosed via VulDB, though the EPSS score of 0.02% (6th percentile) reflects the product's extremely limited deployment footprint; no active exploitation is confirmed.