CVE-2025-12326

Executive Summary

CVE-2025-12326 is a critical SQL injection vulnerability discovered in the shawon100 RUET Online Judge (OJ) application, up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The flaw resides in the /process.php file, specifically within the POST request handler, where the un argument is directly concatenated into SQL queries without sanitization or parameterization. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, authentication bypass, or full database compromise.

The vendor (shawon100) was contacted but did not respond, and no official patch or versioning system exists for this product. The exploit has been publicly disclosed, increasing the risk of active exploitation. Despite a low EPSS score (0.0%), the public availability of exploit code and the lack of a patch make this a high-priority threat for any organization using this software.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby). It is a standalone web application (RUET Online Judge) hosted on a web server. The risk is limited to direct deployments of this application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Base Score: 7.3 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability cannot affect other components.
• Confidentiality Impact: High (C:H) – Full database read access possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: Low (A:L) – Potential for denial of service via SQL injection.

Threat Level: High. The combination of remote exploitability, no authentication, public exploit code, and no available patch makes this a critical risk for affected systems.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the /process.php endpoint. The application likely constructs a SQL query by directly concatenating the un POST parameter without any sanitization or prepared statements. For example, the vulnerable code might resemble:

$username = $_POST['un'];
$query = "SELECT * FROM users WHERE username = '$username'";
$result = mysqli_query($conn, $query);

An attacker can inject SQL by providing a value like ' OR '1'='1 to bypass authentication or ' UNION SELECT ... to extract data from other tables. The lack of input validation and the use of string concatenation instead of parameterized queries are the root causes.

The application does not use versioning, so all deployments up to the identified commit are vulnerable. The vendor's unresponsiveness means no official fix exists.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the recommended fix.

Vulnerable Code (PHP):

<?php
$username = $_POST['un'];
$query = "SELECT * FROM users WHERE username = '$username'";
$result = mysqli_query($conn, $query);
?>

Patched Code (Recommended):

<?php
$username = $_POST['un'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);
$stmt->execute();
$result = $stmt->get_result();
?>

The fix uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Exploitation)

The exploit is publicly available. Below is a simple proof-of-concept using curl to test for SQL injection.

Exploit Command:

curl -X POST http://target.com/process.php -d "un=' OR '1'='1"

If the application returns data or a different response than expected, it is vulnerable. For data extraction, use a UNION-based injection:

curl -X POST http://target.com/process.php -d "un=' UNION SELECT 1,2,3,4,5-- -"

Lab Setup:

1. Deploy a local instance of RUET OJ using the vulnerable commit.
2. Use a tool like sqlmap for automated exploitation:

   sqlmap -u "http://localhost/process.php" --data="un=test" --batch --dbs
   

3. Alternatively, use a manual approach with Burp Suite to intercept and modify the POST request.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for suspicious POST requests to /process.php containing SQL keywords (OR, UNION, SELECT, --, ').
• Use a Web Application Firewall (WAF) to block requests with SQL injection patterns.

Defense:

• Immediately isolate any systems running this software.
• Apply virtual patching via WAF rules.
• If possible, rewrite the vulnerable code using prepared statements (see patched code above).
• Restrict network access to the application to trusted IPs only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /process.php with un parameter containing SQL injection patterns (e.g., ' OR, UNION SELECT, --).
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified or new files in the web root (e.g., webshells uploaded via INTO OUTFILE).
• Log IOCs:
  • Web server logs showing repeated requests to /process.php with varying un values.
  • Database logs showing unexpected queries or errors.

Detection Engineering

YARA Rule

rule CVE_2025_12326_SQLi_ProcessPHP {
    meta:
        description = "Detects SQL injection attempts targeting /process.php in RUET OJ"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12326"
    strings:
        $s1 = "/process.php" ascii nocase
        $s2 = "un=" ascii nocase
        $sqli1 = /un=.*('|%27).*(OR|or|UNION|union|SELECT|select)/ ascii nocase
        $sqli2 = /un=.*(--|%23|#)/ ascii nocase
    condition:
        $s1 and $s2 and ($sqli1 or $sqli2)
}

Sigma Rule

title: SQL Injection Attempt Against RUET OJ /process.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the /process.php endpoint of RUET OJ
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-12326
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/process.php'
        cs-uri-query|contains: 'un='
    keywords:
        - ' OR '
        - ' UNION '
        - ' SELECT '
        - '--'
        - '#'
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in usernames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12326 SQL Injection Attempt on /process.php"; flow:to_server,established; content:"POST"; http_method; content:"/process.php"; http_uri; content:"un="; http_client_body; pcre:"/un=.*('|%27).*(OR|or|UNION|union|SELECT|select)/Pi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the network if possible.
2. Apply virtual patching using a WAF to block SQL injection patterns targeting /process.php.
3. Restrict access to the application to trusted IP addresses only.

Long-Term Fix:

• Since the vendor is unresponsive, the only permanent fix is to rewrite the vulnerable code using prepared statements (see patched code example above).
• If you are the maintainer, fork the repository and apply the fix.
• Consider migrating to a different, actively maintained online judge platform.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Monitor logs for any signs of successful exploitation (e.g., unexpected database output, new files).

Valters IT – Securing your digital frontier.