CVE-2025-15196

Executive Summary

CVE-2025-15196 is a SQL injection vulnerability in the login.php component of code-projects Assessment Management 1.0, exploitable through the userid parameter. The flaw allows an unauthenticated, remote attacker to manipulate backend SQL queries, potentially bypassing authentication or extracting sensitive data. At CVSS 7.3 with a publicly available exploit and no vendor patch, the risk to any internet-exposed deployment remains significant.

Technical Analysis

The vulnerability resides in the login.php file of the Assessment Management 1.0 web application. Per the NVD description, an attacker can manipulate the userid argument to inject SQL statements into a backend query. The affected component is identified as an "unknown part" of login.php, meaning specific underlying functions, query construction routines, or database abstraction layers are not publicly enumerated.

At the vulnerability-class level, this is a classic CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., injection) issue manifesting specifically as SQL injection. The mechanism is well understood: user-supplied input from the userid parameter is concatenated into a SQL query without adequate sanitization, parameterization, or escaping. Because the vulnerable endpoint is a login handler, the injection most plausibly occurs within an authentication lookup (e.g., a SELECT statement verifying user credentials), though the NVD entry does not confirm the exact query structure. Any table, column, or query construct referenced beyond the userid parameter would be speculative and is therefore not asserted here.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is network-reachable, requires no privileges, needs no user interaction, and has low complexity. Scope is unchanged (S:U), and confidentiality, integrity, and availability impacts are each rated Low (C:L/I:L/A:L), consistent with an injection that may expose or modify some data but does not necessarily grant full database or host control. The EPSS score of 0.00427 (34.7th percentile) indicates low predicted near-term exploitation probability relative to the broader CVE corpus, but the public availability of an exploit meaningfully raises real-world risk for exposed instances.

Authentication-management files like login.php are high-value targets because they sit at the perimeter and are accessible pre-authentication. Even a low-impact injection here can enable credential bypass, enumeration, or data exfiltration that cascades into further compromise.

Exploitation Scenarios

No public PoC code details or weaponized payload strings are provided in the source data; the attack chain below is described strictly at the vulnerability-class level. The NVD entry does state the exploit is publicly available and "might be used."

1. Reconnaissance / Target Identification: An attacker enumerates internet-facing instances of Assessment Management 1.0, using Shodan-style queries (e.g., http.html:"Assessment Management" or http.title:"Login") to locate deployments exposing login.php. Fingerprinting the application version helps confirm the 1.0 target.

2. Triggering the Flaw: The attacker locates the login form backed by login.php and identifies the userid parameter (typically submitted via GET or POST through that form). Because the parameter is not properly neutralized, injecting SQL metacharacters into userid alters the structure of the backend query executed by the authentication logic.

3. Payload / Execution (class-level): The attacker supplies crafted input in the userid field designed to manipulate the query's logic (for example, to make an authentication condition evaluate true regardless of the correct password). This is accomplished through classic SQL injection techniques — tautology-based logic manipulation and/or UNION-style data extraction — using the vulnerable userid parameter as the injection point. No specific payload is asserted, as none is provided in the source data.

4. Post-Exploitation Impact: Successful exploitation may bypass authentication (granting unauthorized access to the application), allow enumeration or extraction of data stored in the backend database, or permit modification of data, consistent with the Low confidentiality and integrity impact ratings. An authenticated foothold could then be used to pivot toward further application functionality or lateral movement depending on the deployment.

Impact Assessment

Successful exploitation of CVE-2025-15196 can lead to unauthorized access to the Assessment Management application, exposure of database contents (e.g., user records, assessment data, credentials), and possible data tampering. The CVSS 7.3 (High) rating reflects network reachability, no required privileges, no user interaction, and low complexity. The Scope:Unchanged rating means the impact is confined to the vulnerable component's security authority, and the Low (L) ratings on confidentiality, integrity, and availability indicate partial rather than total loss — but authentication bypass alone can materially expand the blast radius.

Affected systems are any deployments of code-projects Assessment Management 1.0 reachable by untrusted networks. Because this is a pre-authentication endpoint (login.php), the effective blast radius includes every user and dataset managed by the application. Organizations running this software on internet-exposed infrastructure face the highest exposure. The absence of CISA KEV listing and a low EPSS score suggest limited observed exploitation so far, but the public exploit raises the likelihood of opportunistic scanning and attacks.

Detection Guidance

Sigma Rule

title: SQL Injection Attempt Against Assessment Management login.php (userid)
id: 8f2c1a44-9d3e-4b71-b6a2-1c7e5f0a9d10
status: experimental
description: Detects SQL injection patterns targeting the userid parameter of login.php in code-projects Assessment Management 1.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-15196
author: valtersit.com
date: 2025-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/login.php'
  selection_sqli:
    cs-uri-query|contains:
      - 'userid='
    cs-uri-query|contains|all:
      - "'"
  selection_keywords:
    cs-uri-query|contains:
      - 'union'
      - 'select'
      - 'or 1=1'
      - '--'
      - 'sleep('
      - 'benchmark('
  condition: selection_endpoint and selection_sqli and selection_keywords
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate input containing apostrophes in usernames
level: high

YARA Rule

rule CVE_2025_15196_Assessment_Management_SQLi
{
    meta:
        description = "Detects SQL injection payloads targeting the userid parameter in code-projects Assessment Management login.php (CVE-2025-15196)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15196"
        date = "2025-01-01"
        severity = "high"

    strings:
        $login = "login.php" ascii nocase
        $p_userid = "userid=" ascii nocase
        $sqli1 = "union select" ascii nocase
        $sqli2 = "' or '1'='1" ascii nocase
        $sqli3 = "' or 1=1" ascii nocase
        $sqli4 = "or 1=1--" ascii nocase
        $sqli5 = "' or '" ascii nocase

    condition:
        $login and $p_userid and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-15196 SQL Injection Attempt Against Assessment Management login.php (userid)"; flow:established,to_server; http.uri; content:"/login.php"; http.uri; content:"userid="; http.uri; pcre:"/userid=[^&]*(%27|'|union|select|or\+1%3D1|or\s+1=1|--|sleep\(|benchmark\()/i"; classtype:web-application-attack; sid:202515196; rev:1; reference:cve,2025-15196; metadata:service http;)

Elastic Detection

sequence by source.ip
  [any where http.request.method == "GET" and url.path endsWith "/login.php" and url.query contains "userid="]
  [any where url.query contains ("union" or "select" or "' or 1=1" or "--" or "sleep(" or "benchmark(")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| search uri_path="*login.php*" uri_query="*userid=*"
| eval sqli_sig=if(match(lower(uri_query), "(union|select|or\+1%3d1|or\s+1=1|%27|\'|--|sleep\(|benchmark\()"), "matched", "none")
| where sqli_sig="matched"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as payloads by src_ip, uri_path, http_method
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,sqli,">
  <rule id="100596" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>login.php</match>
    <match>userid=</match>
    <regex>(?i)(union.{0,10}select|or\s+1=1|%27|\'|--|sleep\(|benchmark\()</regex>
    <description>CVE-2025-15196: Possible SQL injection attempt against Assessment Management login.php (userid)</description>
    <group>sqli,cve-2025-15196,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix is currently available for code-projects Assessment Management 1.0.

1. Immediate Mitigations:

• Restrict network access to login.php and the application behind authentication, VPN, or allow-listed source IPs; do not expose it directly to the internet.
• Deploy a Web Application Firewall (WAF) with SQL injection signatures and restrict metacharacters in the userid parameter.
• Monitor web-server and WAF logs for injection patterns against login.php (see Detection Guidance).
• Where feasible, disable or rename the vulnerable application until a fix is available.

2. Patch/Upgrade Steps:

• No patch exists. Monitor the code-projects Assessment Management project for an updated release; apply a fixed version as soon as one is published.
• If the project is abandoned, plan migration to a maintained assessment/management platform.

3. Long-Term Hardening:

• Convert application database access to parameterized queries / prepared statements so user input is never concatenated into SQL.
• Apply strict server-side input validation on the userid parameter (type, length, character set).
• Enforce least-privilege database accounts for the application; avoid privileged DB roles for web-facing queries.
• Add centralized logging, alerting, and regular dependency/vulnerability scanning for the deployment.

References

• NVD — CVE-2025-15196: https://nvd.nist.gov/vuln/detail/CVE-2025-15196
• MITRE CWE-74 (Injection): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (CVE-2025-15196): https://api.first.org/data/v1/epss?cve=CVE-2025-15196
• CISA KEV Catalog (CVE-2025-15196 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild evidence: The NVD description states the exploit is publicly available and "might be used." No named threat actor campaign is associated with CVE-2025-15196 in the source data.