CVE-2025-8251
📋 TL;DR
This critical SQL injection vulnerability in Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /admin/delete_s4.php. Organizations using this software are affected, potentially leading to data theft, modification, or deletion. The vulnerability is remotely exploitable and public exploit details are available.
💻 Affected Systems
- Exam Form Submission
📦 What is this software?
Exam Form Submission by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, or deletion; potential privilege escalation to system-level access; installation of backdoors or malware.
Likely Case
Unauthorized access to sensitive student/exam data, manipulation of exam records, potential credential theft from database.
If Mitigated
Limited impact due to network segmentation, proper input validation, and database user privilege restrictions.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub. SQL injection via ID parameter is straightforward to exploit with common SQL injection tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement proper input validation and parameterized queries for the ID parameter in delete_s4.php
Modify delete_s4.php to use prepared statements: $stmt = $conn->prepare('DELETE FROM table WHERE id = ?'); $stmt->bind_param('i', $id);
Access Restriction
allRestrict access to /admin/ directory using web server configuration or authentication
# Apache: <Location /admin/> Require valid-user </Location>
# Nginx: location /admin/ { auth_basic 'Restricted'; }
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) with SQL injection rules
- Network segmentation to isolate the vulnerable system from sensitive data
🔍 How to Verify
Check if Vulnerable:
Test the /admin/delete_s4.php endpoint with SQL injection payloads like: ID=1' OR '1'='1Check Version:
Check software version in documentation or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer work and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed delete operations
- Suspicious patterns in web server access logs for /admin/delete_s4.php
Network Indicators:
- SQL injection patterns in HTTP requests to delete_s4.php
- Unusual database connection patterns
SIEM Query:
source=web_logs AND uri_path="/admin/delete_s4.php" AND (query_string="*'*" OR query_string="*%27*")