CVE-2025-15195

Executive Summary

CVE-2025-15195 is an unauthenticated SQL injection vulnerability in code-projects Assessment Management 1.0, specifically within the /admin/add-module.php file via manipulation of the linked[] parameter. With a CVSS score of 7.3 and a public exploit available, this flaw allows remote attackers to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the underlying database. Organisations using this web application for academic or corporate assessment tracking are at immediate risk due to the lack of an official vendor patch.

Technical Analysis

The vulnerability exists in the code-projects Assessment Management application, version 1.0. According to the NVD description, the issue affects "some unknown functionality" of the /admin/add-module.php file. The specific attack vector is the manipulation of the linked[] argument, which is used to pass data to the backend database. This manipulation results in a SQL injection (SQLi) flaw, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

The root cause is likely the lack of proper input sanitisation or parameterised queries when processing the linked[] array. When the application constructs SQL queries using this user-supplied input without adequate escaping or prepared statements, an attacker can inject malicious SQL syntax. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates that the attack can be launched remotely over the network, requires low attack complexity, and needs no privileges or user interaction. This makes it highly exploitable by any remote attacker who can reach the /admin/add-module.php endpoint.

The linked[] parameter name suggests that the application expects an array of linked items (likely module IDs or similar references) to be submitted. In PHP, array parameters are often processed using functions like implode() to convert them into a comma-separated list for database insertion. If this string is directly concatenated into an SQL query without sanitisation, an attacker can inject SQL commands by manipulating the array values. The public disclosure of the exploit code confirms that the injection point is reachable and functional, although the exact payload structure is not detailed in the NVD entry.

Given the CVSS impact subscores (C:L/I:L/A:L), a successful exploit could lead to low-level confidentiality, integrity, and availability impacts. This typically means an attacker could read sensitive data (e.g., user credentials, assessment results), modify database records (e.g., alter grades, modules), or cause minor disruptions (e.g., delete tables). The fact that the file is located under /admin/ suggests it is part of an administrative interface, but the PR:N vector indicates that authentication is not required to trigger the vulnerability, possibly due to missing access controls or session validation on that endpoint.

Exploitation Scenarios

The attack chain for CVE-2025-15195 can be described at the vulnerability-class level, as no public PoC code is available in the provided intelligence (only the status "Public" is noted). The steps are inferred from the SQL injection class and the specific endpoint.

1. Reconnaissance/Target Identification: An attacker scans the internet for instances of code-projects Assessment Management 1.0. This can be done using search engines or Shodan dorks targeting the application's unique HTML content or login pages. The presence of /admin/add-module.php is a likely indicator of a vulnerable installation.

2. Triggering the Flaw: The attacker sends an HTTP POST request to the /admin/add-module.php endpoint. The request includes the linked[] parameter, likely as part of a form submission to add a new module. The attacker injects SQL syntax into one or more elements of the linked[] array. Because the application fails to sanitise this input, the injected SQL is executed by the database.

3. Payload/Execution Method: At the vulnerability-class level, the attacker can use standard SQL injection techniques such as boolean-based blind, time-based blind, error-based, or UNION-based injection. The specific payload depends on the database backend (likely MySQL or MariaDB, common for PHP applications). For example, an attacker might inject a payload that causes a delay (e.g., SLEEP(5)) to confirm the injection, or one that extracts data via UNION SELECT. The linked[] parameter being an array means the injection could occur through multiple values, potentially allowing for complex queries.

4. Post-Exploitation Impact: Successful exploitation could allow the attacker to bypass authentication, retrieve sensitive data from the database (e.g., admin credentials, student records, assessment data), modify or delete data, and potentially execute administrative operations on the database. Depending on the database privileges, the attacker might also be able to write files to the server or execute operating system commands, leading to full server compromise. The low impact subscores suggest that while data can be compromised, the attacker may be limited in scope, but the lack of patching and public exploit availability heightens the risk.

No public PoC is available in the provided data; the attack chain is inferred from the SQL injection vulnerability class and the specific NVD details.

Impact Assessment

The business impact of CVE-2025-15195 is significant for organisations relying on code-projects Assessment Management 1.0 for educational or corporate assessments. The CVSS score of 7.3 (High) reflects the ease of exploitation (AV:N/AC:L/PR:N/UI:N) and the potential for data breaches. The confidentiality impact (C:L) means that sensitive information such as user credentials, assessment results, and personal data could be exposed. The integrity impact (I:L) allows attackers to alter database records, potentially manipulating grades, module configurations, or other critical data. The availability impact (A:L) could result in minor disruptions, such as database errors or temporary service outages.

The blast radius depends on the deployment: if the application is internet-facing, any remote attacker can exploit it; if internal, a malicious insider or compromised internal host could do so. The lack of a vendor patch (Patch Confidence 0/4) means that all installations of version 1.0 are vulnerable indefinitely unless mitigated through other means. The EPSS score of 0.00427 (34.7th percentile) indicates a relatively low probability of exploitation in the wild within 30 days, but the public disclosure and ease of exploitation could increase this over time.

Affected systems are those running code-projects Assessment Management 1.0. No other versions are listed as affected, but it is prudent to assume all versions prior to any hypothetical fix are at risk. The CISA KEV status is "NO", meaning it is not currently known to be exploited in the wild, but the public PoC availability raises the risk of future exploitation.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt in code-projects Assessment Management add-module.php
id: 8a3c4e5f-6b7c-4d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects SQL injection attempts targeting the linked[] parameter in /admin/add-module.php
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-15195
author: Threat Intelligence Team
date: 2025-04-10
tags:
  - attack.t1190
  - attack.initial_access
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/admin/add-module.php'
    cs-uri-query|contains: 'linked%5B%5D='
  keywords:
    - 'SELECT'
    - 'UNION'
    - 'SLEEP'
    - 'BENCHMARK'
    - 'OR 1=1'
    - 'AND 1=1'
  condition: selection and keywords
falsepositives:
  - Legitimate administrative activity with unusual input
level: high

YARA Rule

rule CVE_2025_15195_SQLi_Detection
{
    meta:
        description = "Detects SQL injection patterns in HTTP requests to /admin/add-module.php"
        author = "Threat Intelligence Team"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15195"
        severity = "high"

    strings:
        $uri = "/admin/add-module.php"
        $param = "linked[]"
        $sqli1 = "SELECT"
        $sqli2 = "UNION"
        $sqli3 = "SLEEP("
        $sqli4 = "BENCHMARK("
        $sqli5 = "OR 1=1"
        $sqli6 = "AND 1=1"
        $sqli7 = "' OR '"
        $sqli8 = "\" OR \""

    condition:
        $uri and $param and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-15195 SQL Injection Attempt in code-projects Assessment Management add-module.php"; flow:to_server,established; content:"POST"; http_method; content:"/admin/add-module.php"; http_uri; content:"linked[]"; http_client_body; pcre:"/(SELECT|UNION|SLEEP|BENCHMARK|OR\s+1=1|AND\s+1=1)/i"; reference:cve,2025-15195; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-15195; classtype:web-application-attack; sid:10000001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [http where http.request.method == "POST" and url.path == "/admin/add-module.php" and http.request.body contains "linked[]"]
  [http where http.request.method == "POST" and url.path == "/admin/add-module.php" and http.request.body regex ".*(SELECT|UNION|SLEEP|BENCHMARK|OR\\s+1=1|AND\\s+1=1).*"]

Splunk SPL Query

index=web sourcetype=access_combined
method=POST uri="/admin/add-module.php"
| regex body="linked(\[\]|%5B%5D)=.*?(SELECT|UNION|SLEEP|BENCHMARK|OR\+1=1|AND\+1=1)"
| stats count by src_ip, uri, body
| where count > 0

Wazuh OSSEC Rule

<group name="web,sql_injection,">
  <rule id="100001" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <match>POST</match>
    <url>/admin/add-module.php</url>
    <regex>linked(\[\]|%5B%5D)=.*?(SELECT|UNION|SLEEP|BENCHMARK|OR\+1=1|AND\+1=1)</regex>
    <description>CVE-2025-15195: SQL injection attempt in code-projects Assessment Management add-module.php</description>
    <group>sql_injection,web_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict access to /admin/add-module.php to trusted IP addresses or require additional authentication layers (e.g., HTTP Basic Auth, VPN) if the application is internet-facing.
   • Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in requests to this endpoint. Use the Suricata rule above as a basis for WAF configuration.
   • Monitor web server logs for suspicious POST requests containing SQL keywords in the linked[] parameter.
   • If possible, temporarily disable the module addition functionality until a fix is available.

2. Patch/Upgrade Steps:

   • No official patch is available from the vendor. Contact code-projects directly for a security update or consider migrating to an alternative, actively maintained assessment management system.
   • If source code is accessible, manually remediate by implementing parameterised queries or prepared statements for the linked[] parameter in /admin/add-module.php. Ensure all user input is sanitised and validated before being used in SQL queries.

3. Long-Term Hardening:

   • Conduct a security audit of the entire application to identify other SQL injection vulnerabilities.
   • Enforce the principle of least privilege for database accounts used by the application.
   • Implement regular vulnerability scanning and penetration testing for custom web applications.
   • Educate developers on secure coding practices, particularly regarding SQL injection prevention (OWASP Top 10).

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-15195
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2025-15195
• code-projects Assessment Management project page: (no official advisory available)
• CWE-74: https://cwe.mitre.org/data/definitions/74.html
• OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
• No known threat actor campaigns or exploit-in-the-wild evidence at this time (CISA KEV: NO).