CVE-2025-12327

Executive Summary

CVE-2025-12327 is a publicly disclosed SQL injection vulnerability in the shawon100 RUET OJ (Online Judge) platform, affecting all versions up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The flaw resides in /description.php where the ID parameter is not sanitized, allowing remote unauthenticated attackers to inject arbitrary SQL commands. With a CVSS score of 6.3 (Medium), the vulnerability can lead to data exfiltration, authentication bypass, or further compromise of the database backend. No official patch exists, and the vendor has not responded to disclosure attempts. The exploit is publicly available, increasing the risk of active exploitation.

Supply Chain & Package Security

This is a custom PHP application (RUET OJ) and is not distributed via NPM, PyPI, Go, or Ruby registries. However, if the application is deployed via Docker or other container registries, those images should be considered compromised until patched.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are the same.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Limited service disruption possible.

Threat Level: Medium. The low EPSS score (0.0%) suggests limited active exploitation currently, but the public PoC and lack of patch make it a ticking time bomb for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the ID parameter of /description.php. The application likely constructs a SQL query by directly concatenating user input without proper sanitization or parameterized queries. For example:

$id = $_GET['ID'];
$query = "SELECT * FROM problems WHERE id = $id";

An attacker can inject SQL syntax by providing input like 1 OR 1=1 or 1 UNION SELECT .... This allows extraction of arbitrary data from the database, including user credentials, problem data, or system tables.

The rolling release model means there is no fixed version number; the only known vulnerable commit is 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. Any deployment based on or before this commit is vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

<?php
$id = $_GET['ID'];
$result = mysqli_query($conn, "SELECT * FROM problems WHERE id = $id");
?>

Patched Code (Parameterized Query):

<?php
$id = $_GET['ID'];
$stmt = $conn->prepare("SELECT * FROM problems WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
?>

The fix uses prepared statements to separate SQL logic from data, preventing injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a local instance of RUET OJ using the vulnerable commit.
2. Use a tool like sqlmap or manual injection.

Manual Exploit Example:

curl "http://target/description.php?ID=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"

Automated Exploit with sqlmap:

sqlmap -u "http://target/description.php?ID=1" --batch --dbs

Expected Outcome: Database enumeration, data exfiltration, or authentication bypass.

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual ID parameter patterns (e.g., UNION, SELECT, OR 1=1).
• Deploy a WAF rule to block SQL injection patterns.

Honeypot:

• Set up a decoy /description.php endpoint that logs all requests and alerts on suspicious input.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /description.php with ID parameter containing SQL keywords (UNION, SELECT, OR, AND, --, #).
• Logs: Database error messages in application logs (e.g., You have an error in your SQL syntax).
• File: Unexpected files in the web root (e.g., webshells uploaded via INTO OUTFILE).
• Database: New or modified records in user tables, or presence of sqlmap-created temporary tables.

Detection Engineering

YARA Rule

rule CVE_2025_12327_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-12327 in RUET OJ"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12327"
    strings:
        $sqli1 = /ID\s*=\s*[^&]*\b(UNION|SELECT|OR|AND|--|#|DROP|INSERT|UPDATE|DELETE)\b/i
        $sqli2 = /description\.php.*ID\s*=\s*[^&]*['"]/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt on RUET OJ /description.php
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection patterns in ID parameter of /description.php
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - "ID=1'"
            - "ID=1 OR"
            - "ID=1 UNION"
            - "ID=1--"
    condition: selection
falsepositives:
    - Legitimate use of special characters in problem IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12327 SQL Injection Attempt"; flow:to_server; content:"/description.php"; http_uri; content:"ID="; http_uri; pcre:"/ID\s*=\s*[^&]*\b(UNION|SELECT|OR|AND|--|#|DROP|INSERT|UPDATE|DELETE)\b/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable server from the internet if possible.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block SQL injection patterns.
3. Audit the codebase and replace all raw SQL queries with parameterized statements.

Long-Term Fix:

• Since the vendor is unresponsive, fork the repository and apply the patch manually.
• Implement input validation and prepared statements across the entire application.
• Consider migrating to a maintained fork or alternative platform.

Detection:

• Deploy the YARA, Sigma, and Suricata rules above.
• Enable detailed logging for all database queries and web requests.

Valters IT
DevSecOps & Cyber Threat Intelligence