CVE-2025-15196
📋 TL;DR
CVE-2025-15196 is an SQL injection vulnerability in code-projects Assessment Management 1.0 that allows attackers to execute arbitrary SQL commands via the userid parameter in login.php. This can lead to unauthorized data access, modification, or deletion. Organizations using Assessment Management 1.0 are affected.
💻 Affected Systems
- code-projects Assessment Management
📦 What is this software?
Assessment Management by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution if database permissions allow.
Likely Case
Unauthorized access to sensitive assessment data, user credentials, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and database permission restrictions in place.
🎯 Exploit Status
Exploit is publicly available and can be launched remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in login.php.
🔧 Temporary Workarounds
Implement Input Validation
allAdd server-side validation to sanitize userid parameter before processing.
Edit login.php to validate userid input using regex or type checking
Use Parameterized Queries
allReplace direct SQL concatenation with prepared statements.
Modify SQL queries in login.php to use parameterized queries
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict network access to the application to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Test login.php with SQL injection payloads in userid parameter (e.g., ' OR '1'='1).Check Version:
Check application version in admin panel or configuration files.Verify Fix Applied:
Verify that SQL injection payloads no longer work and proper input validation is implemented.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed login attempts with SQL-like patterns
Network Indicators:
- HTTP requests to login.php with SQL injection payloads in parameters
SIEM Query:
source="web_logs" AND uri="/login.php" AND (userid CONTAINS "' OR" OR userid CONTAINS "--" OR userid CONTAINS ";")