CVE-2025-12327: Shawonruet Ruet Oj SQL Injection Vulnerability

CVE-2025-12327 Overview

CVE-2025-12327 is a SQL injection vulnerability in shawon100 RUET OJ, an open-source online judge platform. The flaw resides in /description.php, where the ID parameter is passed to a database query without proper sanitization. Remote attackers with low-level authenticated access can manipulate the parameter to alter SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances. Because RUET OJ uses a rolling release model, specific fixed version identifiers are not published. The vendor was contacted before disclosure but did not respond. The affected commit reference is 18fa45b0a669fa1098a0b8fc629cf6856369d9a5 and earlier.

Critical Impact
Authenticated remote attackers can inject arbitrary SQL through the ID parameter in /description.php, potentially disclosing or modifying database contents.

Affected Products

shawon100 RUET OJ up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5
Rolling release builds with no versioned fix identifier
Deployments exposing /description.php to untrusted users

Discovery Timeline

2025-10-27 - CVE-2025-12327 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12327

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] and injection weakness [CWE-74] in the RUET OJ online judge application. The /description.php endpoint accepts an ID argument from the request and incorporates it directly into a backend SQL query. Because the input is not parameterized or validated, an attacker can supply crafted values that break out of the intended query structure. Successful exploitation can read arbitrary rows, enumerate schema information, or modify records depending on the underlying database permissions. The attack is remote and requires only low privileges typical of any authenticated judge user. The public disclosure of the technique lowers the barrier for reuse in automated scanning.

Root Cause

The root cause is the concatenation of untrusted user input into a SQL statement without prepared statements or input validation. The ID parameter passed to /description.php is treated as trusted data. There is no type enforcement (for example, casting to integer) and no allow-list filtering before the value reaches the query builder.

Attack Vector

An attacker sends an HTTP request to /description.php with a malicious ID value containing SQL syntax such as UNION SELECT, boolean-based payloads, or time-based blind constructs. The manipulated query executes with the privileges of the RUET OJ database user. Attackers can chain the flaw with information disclosure to enumerate tables, extract credentials, or pivot deeper into the application. Because interaction with the endpoint is scriptable, exploitation can be automated using tooling such as sqlmap.

See the VulDB entry #330104 for additional technical context. No verified proof-of-concept code is included here.

Detection Methods for CVE-2025-12327

Indicators of Compromise

Web server logs showing GET /description.php?ID= requests containing SQL keywords such as UNION, SELECT, SLEEP, --, or OR 1=1
Anomalous response sizes or HTTP 500 errors originating from /description.php
Database error strings returned to clients referencing MySQL syntax or column mismatches
Unusual outbound queries executed under the RUET OJ database account

Detection Strategies

Deploy web application firewall (WAF) signatures for common SQL injection payloads targeting the ID parameter
Enable database query logging and alert on statements referencing information_schema from the application user
Correlate authentication events with request bursts to /description.php from a single session

Monitoring Recommendations

Baseline normal request patterns for /description.php and alert on parameter length or character-class deviations
Ingest web, application, and database logs into a centralized platform for cross-source correlation
Track and review any failed SQL statements to catch reconnaissance attempts before successful exploitation

How to Mitigate CVE-2025-12327

Immediate Actions Required

Restrict access to the RUET OJ instance to trusted networks or authenticated internal users only
Apply a WAF rule blocking SQL metacharacters in the ID parameter of /description.php
Audit the RUET OJ database user permissions and remove unnecessary write or schema privileges
Review historical web and database logs for prior exploitation attempts

Patch Information

The vendor did not respond to the coordinated disclosure and no official patch identifier is published. Because RUET OJ uses a rolling release model, operators must review upstream commits at the RUET OJ repository and apply source-level fixes that convert the /description.php query to a parameterized statement.

Workarounds

Modify /description.php locally to cast the ID parameter to an integer before use in the query
Replace concatenated SQL with prepared statements using PDO or mysqli bound parameters
Place the application behind an authenticating reverse proxy to limit exposure to unauthenticated scanners
Disable public access to /description.php if the endpoint is not required for production use

bash

# Example WAF rule (ModSecurity) to block SQLi patterns in the ID parameter
SecRule ARGS:ID "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\(|benchmark\(|--|;|/\*)" \
    "id:1012327,phase:2,deny,status:403,\
     msg:'CVE-2025-12327 RUET OJ SQLi attempt on /description.php'"