PT-2025-43930 · Code Projects · Online Event Judging System

Zhonglouguairen · Published 2025-10-27 · Updated 2025-10-28 · CVE-2025-12263

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions code-projects Online Event Judging System version 1.0

Description A flaw exists in code-projects Online Event Judging System 1.0 that allows for remote SQL injection. The issue is located in the file /edit judge.php within an unknown function. Manipulating the judge id argument can trigger the injection. The exploit is publicly available.

Recommendations Apply any available updates to address the SQL injection issue in the /edit judge.php file. As a temporary workaround, restrict access to the /edit judge.php file. Sanitize the judge id argument to prevent SQL injection attacks.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-12263

Affected Products

Online Event Judging System

References · 10

• 🔥 https://github.com/anyizilegong/cve/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12263 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12263 · Vendor Advisory
• https://vuldb.com/?ctiid.329934 · Note
• https://twitter.com/CVEnew/status/1982762935228272871 · Twitter Post
• https://vuldb.com/?submit.674065 · Note
• https://t.me/cveNotify/140432 · Telegram Post
• https://vuldb.com/?id.329934 · Note
• https://twitter.com/RedPacketSec/status/1983116030453879048 · Twitter Post
• https://code-projects.org · Note