CVE-2025-12328
📋 TL;DR
This SQL injection vulnerability in shawon100 RUET OJ allows attackers to manipulate database queries via the Name parameter in /contestproblem.php. Attackers can potentially read, modify, or delete database content. All instances running affected code commits up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 are vulnerable.
💻 Affected Systems
- shawon100 RUET OJ
📦 What is this software?
Ruet Oj by Shawonruet
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, or potential remote code execution if database permissions allow.
Likely Case
Unauthorized data access, privilege escalation, or data corruption through SQL injection.
If Mitigated
Limited impact with proper input validation and parameterized queries in place.
🎯 Exploit Status
Exploit is publicly available but requires understanding of SQL injection techniques. Attack vector is remote.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider implementing parameterized queries and input validation in /contestproblem.php.
🔧 Temporary Workarounds
Implement Input Validation
allAdd strict input validation for the Name parameter to only allow expected characters
Use Parameterized Queries
allReplace direct string concatenation with prepared statements in PHP code
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns targeting /contestproblem.php
- Restrict network access to the application using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check if your RUET OJ instance uses code from commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 or earlier. Review /contestproblem.php for direct SQL concatenation with Name parameter.Check Version:
git log --oneline -1Verify Fix Applied:
Test the Name parameter with SQL injection payloads; successful queries should be blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
Network Indicators:
- HTTP requests to /contestproblem.php with SQL keywords in parameters
SIEM Query:
source=web_logs AND uri_path="/contestproblem.php" AND (param="Name" AND value MATCHES "(?i)(SELECT|UNION|INSERT|DELETE|DROP|--|;)")