CVE-2025-8371
📋 TL;DR
This critical SQL injection vulnerability in Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the 'credits' parameter in /admin/update_s5.php. Organizations using this software are affected, potentially leading to database compromise and data theft.
💻 Affected Systems
- Exam Form Submission
📦 What is this software?
Exam Form Submission by Code Projects
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data exfiltration, privilege escalation, and potential remote code execution on the underlying server.
Likely Case
Unauthorized access to sensitive student/exam data, modification of exam records, and potential administrative account takeover.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data viewing without modification.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires access to the admin interface but no specific authentication beyond that.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries and input validation to the update_s5.php file
Modify /admin/update_s5.php to use prepared statements with PDO or mysqli
Access Restriction
allRestrict access to the vulnerable admin interface
Add .htaccess authentication or IP whitelisting to /admin/ directory
🧯 If You Can't Patch
- Disable or remove the /admin/update_s5.php file entirely
- Implement a web application firewall (WAF) with SQL injection rules
🔍 How to Verify
Check if Vulnerable:
Check if /admin/update_s5.php exists and contains unsanitized 'credits' parameter usageCheck Version:
Check software version in configuration files or about pagesVerify Fix Applied:
Test the update_s5.php endpoint with SQL injection payloads to ensure they're blocked📡 Detection & Monitoring
Log Indicators:
- SQL error messages in web server logs
- Unusual database queries from web application
Network Indicators:
- HTTP POST requests to /admin/update_s5.php with SQL keywords in parameters
SIEM Query:
web.url:*update_s5.php AND (web.param:*UNION* OR web.param:*SELECT* OR web.param:*INSERT*)