CVE-2025-12329
📋 TL;DR
This CVE describes an SQL injection vulnerability in shawon100 RUET OJ's /details.php file through manipulation of the ID parameter. Remote attackers can exploit this to execute arbitrary SQL commands on the database. All deployments of RUET OJ up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 are affected.
💻 Affected Systems
- shawon100 RUET OJ
📦 What is this software?
Ruet Oj by Shawonruet
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-sensitive data.
🎯 Exploit Status
Exploit has been released publicly. SQL injection via ID parameter manipulation is typically straightforward for attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5
Vendor Advisory: Not available - vendor did not respond to disclosure
Restart Required: No
Instructions:
1. Update to latest version from the project repository. 2. Verify the /details.php file has proper input validation and parameterized queries. 3. Test the ID parameter with SQL injection payloads to confirm fix.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the /details.php endpoint
Input Validation Filter
allImplement server-side validation to restrict ID parameter to expected data types
🧯 If You Can't Patch
- Implement strict input validation for the ID parameter in /details.php
- Apply database-level controls: use least privilege accounts, enable query logging
🔍 How to Verify
Check if Vulnerable:
Test /details.php with SQL injection payloads like: details.php?ID=1' OR '1'='1Check Version:
Check git commit hash: git log --oneline -1Verify Fix Applied:
Attempt SQL injection tests and verify they are blocked or properly handled📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple rapid requests to /details.php with varying ID parameters
Network Indicators:
- HTTP requests to /details.php containing SQL keywords (UNION, SELECT, etc.) in parameters
SIEM Query:
source="web_logs" AND uri_path="/details.php" AND (query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*OR*1=1*")