CVE-2025-12254: Carmelo Event Judging System SQLi Flaw

CVE-2025-12254 Overview

CVE-2025-12254 is a SQL injection vulnerability in code-projects Online Event Judging System 1.0. The flaw resides in the /add_judge.php script, where the fullname parameter is passed into a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements against the backend database.

The vulnerability is remotely exploitable over the network and requires low-privilege authentication. The exploit details have been publicly disclosed through VulDB, increasing the likelihood of opportunistic attacks against exposed installations. The issue is tracked under CWE-74 as improper neutralization of special elements in output.

Critical Impact
Authenticated remote attackers can inject SQL through the fullname parameter of /add_judge.php to read, modify, or delete judge and event data stored by the application.

Affected Products

Carmelo Online Event Judging System 1.0
code-projects Online Event Judging System (PHP/MySQL build)
Deployments using the unpatched /add_judge.php endpoint

Discovery Timeline

2025-10-27 - CVE-2025-12254 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12254

Vulnerability Analysis

The Online Event Judging System is a PHP-based web application that uses a MySQL backend to track judges, events, and scoring. The /add_judge.php endpoint accepts user-supplied data to create new judge records. The fullname parameter is concatenated directly into a SQL INSERT statement without parameterized queries or input escaping.

An authenticated attacker submitting crafted input in the fullname field can break out of the intended string context and append arbitrary SQL clauses. This allows union-based extraction of data from other tables, boolean-based blind enumeration, and potentially destructive operations such as UPDATE or DELETE. Public proof-of-concept material is referenced on the GitHub CVE Issue Discussion and VulDB #329925.

Root Cause

The root cause is missing input neutralization on the fullname POST parameter. The application builds SQL queries through direct string concatenation rather than prepared statements with bound parameters. No server-side validation enforces type or character restrictions on the field.

Attack Vector

The attack is network-based and requires an authenticated session at the judge management interface. An attacker submits a malicious fullname value through the add judge form. The injected payload executes within the application's database context, exposing stored credentials, event records, and scoring data.

No verified exploit code is reproduced here. Refer to the VulDB CTII #329925 entry and the linked GitHub issue for technical proof-of-concept details.

Detection Methods for CVE-2025-12254

Indicators of Compromise

POST requests to /add_judge.php containing SQL metacharacters such as single quotes, UNION SELECT, --, or OR 1=1 in the fullname field
Web server access logs showing unusually long or URL-encoded fullname values from a single source IP
Unexpected new rows in the judges table or unauthorized modifications to scoring records
Database error messages referencing syntax errors near the fullname value in application logs

Detection Strategies

Deploy web application firewall rules that inspect POST bodies for SQL injection signatures targeting /add_judge.php
Enable MySQL general query logging and alert on INSERT INTO judges statements containing nested SELECT clauses or stacked queries
Correlate authentication events with subsequent anomalous database query patterns from the same session

Monitoring Recommendations

Monitor application error logs for SQLSTATE exceptions and PHP mysqli warnings tied to the add judge workflow
Track baseline request volumes to /add_judge.php and alert on spikes from individual accounts
Audit privileged database accounts for unexpected SELECT activity against system tables such as information_schema

How to Mitigate CVE-2025-12254

Immediate Actions Required

Restrict access to /add_judge.php to trusted administrative IP ranges until a patched build is deployed
Rotate database and application credentials if injection activity is suspected in historical logs
Review the judges and events tables for unauthorized inserts, updates, or deletions
Deploy WAF signatures that block SQL metacharacters in the fullname parameter

Patch Information

No official vendor advisory or patched release has been published at the time of writing. Administrators should track the Code Projects Resource Hub and the GitHub CVE Issue Discussion for fix availability. Until a patch is released, code owners should modify add_judge.php to use parameterized queries through mysqli prepared statements or PDO with bound parameters.

Workarounds

Replace concatenated SQL in add_judge.php with prepared statements that bind fullname as a string parameter
Apply server-side input validation restricting fullname to alphabetic characters, spaces, and a defined length
Run the application database user with least privilege, removing DROP, ALTER, and FILE permissions
Place the application behind an authenticated reverse proxy to limit exposure to internal users only

bash

# Example hardening: enforce least privilege on the application DB user
mysql -u root -p -e "REVOKE ALL PRIVILEGES ON judging_db.* FROM 'app_user'@'%'; \
  GRANT SELECT, INSERT, UPDATE, DELETE ON judging_db.* TO 'app_user'@'%'; \
  FLUSH PRIVILEGES;"