CVE-2025-9610
📋 TL;DR
This SQL injection vulnerability in code-projects Online Event Judging System 1.0 allows attackers to manipulate database queries through the fname parameter in /create_account.php. Attackers can potentially read, modify, or delete database contents remotely. Any organization using this specific software version is affected.
💻 Affected Systems
- code-projects Online Event Judging System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including credential theft, data destruction, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, account creation/manipulation, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only error messages or partial data exposure.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub and vuldb. SQL injection is a well-understood attack vector with many automated tools available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
1. Check code-projects.org for official patches or updates. 2. If no patch available, implement workarounds or consider alternative software. 3. Apply input validation and parameterized queries to affected files.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to sanitize fname parameter and other inputs
Edit /create_account.php to add input filtering before SQL queries
Web Application Firewall Rules
allBlock SQL injection patterns targeting /create_account.php
Add WAF rule: deny requests to /create_account.php containing SQL keywords in parameters
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the application server
🔍 How to Verify
Check if Vulnerable:
Test /create_account.php with SQL injection payloads in fname parameter (e.g., fname=test' OR '1'='1)Check Version:
Check software documentation or configuration files for version informationVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed account creation attempts with special characters
Network Indicators:
- HTTP POST requests to /create_account.php containing SQL keywords like UNION, SELECT, OR
SIEM Query:
source="web_logs" AND uri_path="/create_account.php" AND (request_body CONTAINS "UNION" OR request_body CONTAINS "SELECT" OR request_body CONTAINS "' OR '")