PT-2025-20585 · Unknown · Project Worlds Student Project Allocation System

Attackxu · Published 2025-05-09 · Updated 2025-05-09 · CVE-2025-4482

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Project Worlds Student Project Allocation System version 1.0

Description A critical vulnerability was found in the system, affecting an unknown functionality of the file /change pass/forgot password sql.php. The manipulation of the argument Pat BloodGroup1 leads to SQL injection. The attack can be launched remotely.

Recommendations For Project Worlds Student Project Allocation System version 1.0, consider restricting access to the /change pass/forgot password sql.php file until a patch is available. As a temporary workaround, avoid using the Pat BloodGroup1 argument in the affected file to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-4482

Affected Products

Project Worlds Student Project Allocation System

References · 11

• 🔥 https://github.com/hhhanxx/attack/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2025-4482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4482 · Security Note
• https://t.me/latest_high_impact_cve/2315 · Telegram Post
• https://vuldb.com/?submit.566719 · Note
• https://t.me/cvetracker/23508 · Telegram Post
• https://vuldb.com/?id.308197 · Note
• https://vuldb.com/?ctiid.308197 · Note
• https://twitter.com/VulmonFeeds/status/1920979195401748922 · Twitter Post
• https://t.me/cvedetector/24976 · Telegram Post
• https://twitter.com/CVEnew/status/1920913617870090402 · Twitter Post