CVE-2025-12255
📋 TL;DR
CVE-2025-12255 is an SQL injection vulnerability in code-projects Online Event Judging System 1.0 affecting the /add_contestant.php file. Attackers can manipulate the 'fullname' parameter to execute arbitrary SQL commands, potentially compromising the database. Organizations using this specific version of the software are affected.
💻 Affected Systems
- code-projects Online Event Judging System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential system takeover via SQL injection leading to remote code execution.
Likely Case
Unauthorized data access, manipulation of contestant/judging data, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit details are publicly available on GitHub and vuldb.com; SQL injection typically requires some authentication but may be exploitable via other vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries as workarounds.
🔧 Temporary Workarounds
Implement Input Validation
PHPAdd server-side validation to sanitize the 'fullname' parameter before processing.
Modify /add_contestant.php to include: $fullname = mysqli_real_escape_string($conn, $_POST['fullname']);
Use Parameterized Queries
PHPReplace direct SQL concatenation with prepared statements to prevent injection.
Update SQL queries in /add_contestant.php to use: $stmt = $conn->prepare('INSERT INTO contestants (fullname) VALUES (?)'); $stmt->bind_param('s', $fullname);
🧯 If You Can't Patch
- Restrict access to /add_contestant.php using web server rules (e.g., .htaccess for Apache).
- Implement a Web Application Firewall (WAF) to block SQL injection attempts.
🔍 How to Verify
Check if Vulnerable:
Test the /add_contestant.php endpoint with SQL injection payloads in the 'fullname' parameter (e.g., ' OR '1'='1).Check Version:
Check the software version in the application's admin panel or configuration files.Verify Fix Applied:
After applying workarounds, retest with SQL injection payloads to ensure they are blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts or unusual database queries from /add_contestant.php
Network Indicators:
- HTTP POST requests to /add_contestant.php containing SQL keywords (e.g., UNION, SELECT, DROP)
SIEM Query:
source="web_logs" AND uri="/add_contestant.php" AND (payload="' OR" OR payload="UNION" OR payload="SELECT")