CVE-2025-10104
📋 TL;DR
This SQL injection vulnerability in code-projects Online Event Judging System 1.0 allows attackers to manipulate database queries through the txtsearch parameter in /review_search.php. Remote attackers can potentially access, modify, or delete database contents. All deployments of version 1.0 are affected.
💻 Affected Systems
- code-projects Online Event Judging System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access and extraction of sensitive information from the database, potentially including user credentials and event data.
If Mitigated
Limited data exposure if database permissions are properly restricted and input validation is implemented elsewhere.
🎯 Exploit Status
Public exploit available on GitHub, SQL injection is a well-understood attack vector with many automated tools available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in the source code.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests to /review_search.php
Input Validation Filter
allImplement server-side input validation to sanitize the txtsearch parameter
🧯 If You Can't Patch
- Isolate the vulnerable system behind a reverse proxy with strict input filtering
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test the /review_search.php endpoint with SQL injection payloads in the txtsearch parameterCheck Version:
Check application version in admin panel or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error messages📡 Detection & Monitoring
Log Indicators:
- Unusual SQL syntax in request logs
- Multiple failed login attempts following SQL payloads
- Database error messages in application logs
Network Indicators:
- SQL keywords in HTTP POST parameters
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND (uri="/review_search.php" AND (param="txtsearch" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "--"))