CVE-2025-12328: Shawonruet Ruet OJ SQL Injection Vulnerability

CVE-2025-12328 Overview

CVE-2025-12328 is a SQL injection vulnerability in shawon100 RUET Online Judge (RUET OJ), an open-source competitive programming platform. The flaw resides in the /contestproblem.php file, where the Name parameter is passed to a database query without proper sanitization. A remote attacker with low privileges can manipulate this parameter to inject arbitrary SQL statements. The project follows a rolling release model, so no discrete version numbers identify affected or fixed builds. The affected commit reference is 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. Public exploitation details have been disclosed, and the vendor did not respond to the researcher's disclosure attempts.

Critical Impact
Authenticated remote attackers can inject SQL through the Name parameter in /contestproblem.php, exposing contest and user data stored in the RUET OJ database.

Affected Products

shawon100 RUET OJ up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5
Deployments built from the RUET OJ rolling release branch
Any downstream fork retaining the vulnerable contestproblem.php query logic

Discovery Timeline

2025-10-27 - CVE-2025-12328 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12328

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] compounded by improper neutralization of special elements in a downstream component [CWE-74]. The contestproblem.php script accepts a Name argument from the HTTP request and concatenates it directly into a SQL statement executed against the backing database. Because no parameterized query or input escaping is applied, an attacker can break out of the string context and append arbitrary SQL clauses.

Exploitation requires network access to the application and a low-privilege account, matching the attack profile of an authenticated contest participant. Successful exploitation yields limited confidentiality, integrity, and availability impact on the database contents, including user records, contest metadata, and problem definitions. Because the exploit technique has been made public, opportunistic reuse against exposed RUET OJ deployments is plausible.

Root Cause

The root cause is direct string concatenation of untrusted request data into a SQL statement inside contestproblem.php. The Name parameter is not validated against an allowlist, escaped through the database driver, or bound using prepared statements. This allows an attacker to alter the query's logic rather than its data.

Attack Vector

The attack vector is network-based. An attacker submits a crafted HTTP request to the /contestproblem.php endpoint with a malicious Name value containing SQL metacharacters and injected clauses. Because authentication is required but privileges are low, any registered judge user can attempt exploitation. The vulnerability mechanism follows the standard union-based and boolean-based SQL injection patterns described in the referenced VulDB submission. See the VulDB entry #330105 for technical details of the disclosed proof of concept.

Detection Methods for CVE-2025-12328

Indicators of Compromise

HTTP requests to /contestproblem.php containing SQL metacharacters such as single quotes, UNION SELECT, --, /*, or OR 1=1 inside the Name parameter.
Database error responses returned to the browser referencing MySQL, MariaDB, or PDO syntax errors triggered from contestproblem.php.
Unexpected outbound traffic or file writes from the PHP application user immediately after suspicious contest page requests.

Detection Strategies

Enable web server access logging and alert on requests to /contestproblem.php where the Name query string or POST body contains SQL keywords or encoded quote characters.
Deploy a web application firewall with an OWASP Core Rule Set profile tuned to block SQL injection payloads against the RUET OJ endpoints.
Instrument the database layer to log queries that reference the Name value verbatim, then review for anomalous UNION, SLEEP, or INFORMATION_SCHEMA usage.

Monitoring Recommendations

Baseline typical query volume and response size for /contestproblem.php and alert on statistical deviations that suggest data extraction.
Monitor MySQL or MariaDB slow query and error logs for repeated failures originating from the RUET OJ database user.
Track authentication events for judge accounts issuing high volumes of contest problem requests from a single source address.

How to Mitigate CVE-2025-12328

Immediate Actions Required

Restrict access to the RUET OJ instance behind an authenticated reverse proxy or VPN while a code-level fix is being prepared.
Deploy WAF rules that block SQL injection payloads targeting the Name parameter in /contestproblem.php.
Rotate database credentials used by the application and audit the users, contest, and problem tables for tampering.

Patch Information

The vendor was contacted about this disclosure but did not respond, and no official patch has been published at the time of writing. Because RUET OJ uses a rolling release model, operators should track the upstream repository for commits that replace concatenated SQL in contestproblem.php with parameterized queries, then rebuild from source. Consult the VulDB CTI entry #330105 for updates on remediation status.

Workarounds

Modify contestproblem.php locally to use prepared statements with bound parameters for the Name value, using mysqli or PDO prepared APIs.
Add server-side input validation that restricts Name to an allowlist of expected characters before it reaches any database function.
Temporarily disable the contest problem view endpoint if the deployment does not require it and public exposure cannot be mitigated.

bash

# Example nginx location block to block obvious SQL injection payloads
location = /contestproblem.php {
    if ($arg_Name ~* "(union|select|sleep\(|information_schema|--|/\*)") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}