CVE-2025-10617: Razormist Polling System SQLi Flaw

CVE-2025-10617 Overview

CVE-2025-10617 is a SQL injection vulnerability in SourceCodester Online Polling System 1.0, developed by razormist. The flaw resides in the /admin/positions.php script, where the ID parameter is passed directly into a SQL query without proper sanitization. A remote attacker with low-privilege access can manipulate the parameter to inject arbitrary SQL statements. Public exploit details have been disclosed, increasing the likelihood of opportunistic exploitation against exposed installations. The weakness is tracked under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Authenticated remote attackers can read, modify, or delete database contents through the vulnerable ID parameter in /admin/positions.php.

Affected Products

Razormist Online Polling System 1.0
SourceCodester Online Polling System (distribution channel)
Installations exposing /admin/positions.php to untrusted networks

Discovery Timeline

2025-09-17 - CVE-2025-10617 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10617

Vulnerability Analysis

The vulnerability exists in the administrative interface of the Online Polling System, specifically within /admin/positions.php. The script accepts an ID argument through an HTTP request and incorporates the value into a backend SQL query without parameterization or input validation. This pattern allows an attacker to break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires network reachability to the administrative endpoint and authenticated access at low privilege. Once injected, the attacker can enumerate database schema, extract credentials, modify poll results, or escalate access by tampering with administrator records. Public disclosure of the exploit method increases exposure risk for any internet-facing instance.

Root Cause

The root cause is improper neutralization of user-supplied input passed through the ID GET or POST parameter. The application concatenates the parameter directly into a SQL statement rather than using prepared statements or parameterized queries. Absence of server-side type checking and input filtering allows SQL metacharacters to alter query logic.

Attack Vector

The attack is performed remotely over the network against the /admin/positions.php endpoint. An attacker supplies a crafted value for the ID parameter containing SQL syntax such as union-based or boolean-based payloads. Because the request requires low privileges, any account with administrative panel access can trigger the flaw. See the public proof-of-concept discussion and VulDB entry #324644 for additional technical context.

Detection Methods for CVE-2025-10617

Indicators of Compromise

HTTP requests to /admin/positions.php containing SQL metacharacters such as single quotes, UNION SELECT, --, or OR 1=1 in the ID parameter
Unexpected database errors logged by the PHP application following requests to positions.php
Unusual SELECT volume or sleep-based timing patterns observed in MySQL query logs
New or modified administrative accounts within the polling system database

Detection Strategies

Enable web server access logging and filter for positions.php requests with non-numeric ID values
Deploy database query monitoring to flag malformed or stacked queries from the application user
Use a web application firewall with SQL injection signatures tuned for PHP applications
Correlate failed login attempts with subsequent suspicious requests to administrative scripts

Monitoring Recommendations

Forward web and database logs to a centralized analytics platform for retention and query
Alert on requests where ID parameters contain characters outside the expected numeric range
Monitor outbound connections from the application host that may indicate post-exploitation data exfiltration

How to Mitigate CVE-2025-10617

Immediate Actions Required

Restrict network access to /admin/positions.php using IP allowlists or VPN-only access
Audit administrative accounts and rotate credentials for the polling system database
Deploy a web application firewall rule blocking SQL injection patterns against the affected endpoint
Review web server and database logs for prior exploitation attempts referencing the ID parameter

Patch Information

No official vendor patch has been published for Online Polling System 1.0 at the time of NVD publication. Organizations should consult the SourceCodester project page and the GitHub issue tracker for updates. If no patch is available, consider replacing the application or applying source-level fixes to convert vulnerable queries to prepared statements using PDO or MySQLi parameter binding.

Workarounds

Remove or disable /admin/positions.php if the feature is not required
Implement input validation enforcing integer-only values for the ID parameter before the query executes
Place the application behind an authenticated reverse proxy to limit attacker reachability
Isolate the database user account with least privilege so injection cannot modify schema or administrative tables

bash

# Example WAF rule to block non-numeric ID values on positions.php (ModSecurity)
SecRule REQUEST_URI "@contains /admin/positions.php" \
    "chain,deny,status:403,id:1010617,msg:'Possible SQLi on positions.php ID parameter'"
    SecRule ARGS:ID "!@rx ^[0-9]+$"