CVE-2025-10601: Janobe Online Exam Form SQL Injection

CVE-2025-10601 Overview

A SQL injection vulnerability has been discovered in SourceCodester Online Exam Form Submission version 1.0. The vulnerability exists in the /admin/index.php file, where improper handling of the email parameter allows attackers to inject malicious SQL commands. This flaw enables remote attackers to manipulate database queries without requiring authentication, potentially compromising the integrity and confidentiality of stored data.

Critical Impact
Unauthenticated attackers can remotely exploit this SQL injection vulnerability to extract sensitive data, modify database records, or potentially gain unauthorized administrative access to the Online Exam Form Submission application.

Affected Products

Janobe Online Exam Form Submission 1.0
SourceCodester Online Exam Form Submission /admin/index.php component

Discovery Timeline

2025-09-17 - CVE-2025-10601 published to NVD
2025-09-22 - Last updated in NVD database

Technical Details for CVE-2025-10601

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) occurs due to improper neutralization of special elements used in SQL commands within the /admin/index.php file. The email parameter accepts user-supplied input that is directly incorporated into database queries without adequate sanitization or parameterization. An attacker can craft malicious input containing SQL syntax that alters the intended query logic, potentially bypassing authentication mechanisms or extracting sensitive information from the database.

The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-89 (SQL Injection), indicating a fundamental failure to properly validate and sanitize user input before using it in database operations.

Root Cause

The root cause of this vulnerability is the direct concatenation of user-supplied input from the email parameter into SQL queries without proper input validation, sanitization, or the use of parameterized queries (prepared statements). The application fails to implement secure coding practices that would prevent malicious SQL syntax from being interpreted as executable code by the database engine.

Attack Vector

The attack can be launched remotely over the network without requiring authentication. An attacker targets the /admin/index.php endpoint and manipulates the email parameter with specially crafted SQL injection payloads. Since the exploit has been publicly disclosed, attackers can leverage existing techniques to:

Bypass authentication controls by injecting SQL logic that always evaluates to true
Extract sensitive data from database tables using UNION-based or error-based injection techniques
Modify or delete database records
Potentially escalate privileges within the application

The vulnerability is exploitable via standard HTTP requests, making it accessible to any attacker with network access to the vulnerable application.

Detection Methods for CVE-2025-10601

Indicators of Compromise

Unusual or malformed requests to /admin/index.php containing SQL syntax in the email parameter
Database error messages exposed in application responses indicating SQL syntax errors
Unexpected database query patterns or elevated query execution times
Evidence of data exfiltration or unauthorized database modifications
Log entries showing authentication bypass attempts or admin panel access from unexpected sources

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in the email parameter
Monitor HTTP request logs for suspicious characters and SQL keywords (e.g., ', ", OR, UNION, SELECT, --) in POST/GET parameters
Implement database activity monitoring to detect anomalous query patterns or unauthorized data access
Configure application-level logging to capture and alert on malformed authentication attempts

Monitoring Recommendations

Enable verbose logging for the /admin/index.php endpoint to capture all incoming request parameters
Set up automated alerts for database query failures or SQL syntax errors originating from the application
Monitor for unauthorized administrative access or privilege escalation within the application
Review database audit logs for unexpected SELECT, INSERT, UPDATE, or DELETE operations

How to Mitigate CVE-2025-10601

Immediate Actions Required

Restrict network access to the /admin/index.php endpoint using firewall rules or IP whitelisting
Deploy Web Application Firewall rules specifically targeting SQL injection in the email parameter
Review application logs for evidence of prior exploitation attempts
Consider taking the application offline if it contains sensitive data and cannot be immediately patched

Patch Information

As of the last NVD update on 2025-09-22, no official patch has been released by the vendor. Organizations using Janobe Online Exam Form Submission 1.0 should monitor SourceCodester for security updates. Additional technical details are available through the GitHub CVE Issue Discussion and VulDB #324621.

Workarounds

Implement input validation and sanitization for the email parameter at the application level
Modify the vulnerable code to use parameterized queries or prepared statements instead of string concatenation
Deploy a reverse proxy with SQL injection filtering capabilities in front of the application
Restrict access to the admin interface to trusted IP addresses or require VPN access
If source code modification is possible, apply proper escaping functions before incorporating user input into SQL queries

bash

# Example: Restrict access to admin panel via .htaccess (Apache)
<Files "index.php">
    <FilesMatch "^index\.php$">
        Order Deny,Allow
        Deny from all
        Allow from 192.168.1.0/24
        Allow from 10.0.0.0/8
    </FilesMatch>
</Files>