CVE-2025-8238
📋 TL;DR
A critical SQL injection vulnerability in Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the 'credits' parameter in /admin/update_s2.php. This can lead to data theft, modification, or deletion. All users running the vulnerable version are affected.
💻 Affected Systems
- code-projects Exam Form Submission
📦 What is this software?
Exam Form Submission by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, privilege escalation, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive student/exam data, grade manipulation, and potential administrative account takeover.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts would still be logged.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing custom fixes with parameterized queries.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize the 'credits' parameter before processing
Add input sanitization in /admin/update_s2.php: $credits = mysqli_real_escape_string($connection, $_POST['credits']);
Access Restriction
allRestrict access to the vulnerable file using web server configuration
# Apache: <Location "/admin/update_s2.php">
Order deny,allow
Deny from all
</Location>
# Nginx: location /admin/update_s2.php { deny all; }
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with SQL injection rules
- Restrict database user permissions to minimum required operations
🔍 How to Verify
Check if Vulnerable:
Check if /admin/update_s2.php exists and accepts 'credits' parameter. Test with SQL injection payloads like: credits=1' OR '1'='1Check Version:
Check software version in documentation or configuration files; this is version 1.0 only.Verify Fix Applied:
Test the same SQL injection payloads after implementing fixes; they should be rejected or sanitized.📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application user
- Multiple failed login attempts to admin interface
Network Indicators:
- HTTP POST requests to /admin/update_s2.php with SQL keywords in parameters
- Unusual outbound database connections from web server
SIEM Query:
source="web_logs" AND uri="/admin/update_s2.php" AND (param="credits" AND value CONTAINS "' OR" OR value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "--")