CVE-2025-12327
📋 TL;DR
This SQL injection vulnerability in RUET OJ's /description.php file allows remote attackers to manipulate database queries via the ID parameter. It affects all versions up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The vulnerability is publicly disclosed and could be exploited to access or modify sensitive data.
💻 Affected Systems
- shawon100 RUET OJ
📦 What is this software?
Ruet Oj by Shawonruet
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential authentication bypass and privilege escalation.
Likely Case
Unauthorized data extraction from the database, potentially exposing user information, submissions, or system data.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing successful exploitation.
🎯 Exploit Status
Vulnerability is publicly disclosed but no proof-of-concept is confirmed. SQL injection typically requires some technical knowledge to exploit effectively.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
1. Update to the latest version from the repository. 2. Verify the fix by checking if /description.php uses parameterized queries or proper input validation for the ID parameter.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to ensure ID parameter contains only expected characters
Modify /description.php to validate ID parameter before processing
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule to detect and block SQL injection attempts on /description.php
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in /description.php
- Restrict access to /description.php endpoint using network controls or authentication
🔍 How to Verify
Check if Vulnerable:
Test /description.php with SQL injection payloads in the ID parameter (e.g., ' OR '1'='1)Check Version:
git log --oneline -1 (to check current commit hash)Verify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /description.php with suspicious ID parameters
Network Indicators:
- HTTP requests to /description.php containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri="/description.php" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR*" OR param="*--*")