CVE-2025-12329: Ruet OJ SQL Injection Vulnerability

CVE-2025-12329 Overview

CVE-2025-12329 is a SQL injection vulnerability in shawon100 RUET OJ, an open-source online judge platform. The flaw resides in the /details.php file, where the ID parameter is passed to a database query without proper sanitization. Remote attackers with low privileges can manipulate the parameter to inject arbitrary SQL statements. The project follows a rolling release model, and the affected commit is identified as 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The vendor was contacted prior to public disclosure but did not respond. Exploit details have been published, increasing the risk of opportunistic attacks against exposed instances.

Critical Impact
Authenticated remote attackers can inject SQL into the ID parameter of /details.php, potentially exposing or modifying database contents on affected RUET OJ deployments.

Affected Products

shawon100 RUET OJ up to commit 18fa45b0a669fa1098a0b8fc629cf6856369d9a5
All rolling-release builds prior to a fix for /details.php
Deployments exposing /details.php to untrusted networks

Discovery Timeline

2025-10-27 - CVE-2025-12329 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-12329

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] within the /details.php endpoint of RUET OJ. The ID request parameter is concatenated into a SQL query without parameterization or input validation. An authenticated attacker can supply crafted input containing SQL metacharacters to alter the structure of the query. Successful exploitation allows reading arbitrary records, extracting credentials, or tampering with judge data. Because the application serves programming contest and user data, impact includes exposure of user submissions, email addresses, and hashed credentials.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-74, CWE-89]. The details.php handler trusts the ID query string value and interpolates it directly into a database statement. No prepared statements, bound parameters, or type casting are applied before query execution.

Attack Vector

Exploitation requires network access to the application and valid low-privilege credentials, which are typically obtained through self-registration on the judge. The attacker issues a GET request to /details.php?ID=<payload> with SQL fragments appended to the identifier. Common payloads use UNION-based or boolean-based techniques to exfiltrate data from the backing MySQL database. Public disclosure of the exploit lowers the technical barrier for reproduction.

No verified proof-of-concept code is available in the referenced sources. See the VulDB entry #330106 for additional technical context.

Detection Methods for CVE-2025-12329

Indicators of Compromise

Web server access logs containing requests to /details.php with SQL keywords such as UNION, SELECT, SLEEP, --, or 0x in the ID parameter.
Database error messages referencing MySQL syntax errors returned to clients after requests to /details.php.
Unusual outbound data volume from the application host following suspicious details.php requests.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the ID query parameter on /details.php for SQL metacharacters and tautologies.
Enable MySQL general query logging in staging to baseline expected queries from details.php and alert on deviations.
Correlate authenticated session identifiers with repeated /details.php requests containing non-numeric ID values.

Monitoring Recommendations

Monitor for spikes in 500-series responses from /details.php which often indicate SQL syntax errors during injection attempts.
Alert on account creation followed quickly by repeated requests to vulnerable endpoints, a common pattern for low-privilege exploitation.
Review database audit logs for SELECT statements referencing authentication tables sourced from the web application user.

How to Mitigate CVE-2025-12329

Immediate Actions Required

Restrict access to the RUET OJ instance to trusted networks or require VPN access until a fix is applied.
Disable new account registration to reduce exposure, since exploitation requires a low-privilege account.
Deploy a WAF rule that rejects non-integer values for the ID parameter on /details.php.

Patch Information

No vendor patch has been published. The vendor was contacted before disclosure but did not respond. Operators should fork the repository and apply a local fix that replaces string concatenation in /details.php with prepared statements using PDO or mysqli_prepare, binding the ID parameter as an integer. Track the VulDB entry #330106 for updates.

Workarounds

Cast the ID parameter to an integer at the top of /details.php before any database query executes.
Place the application behind a reverse proxy that enforces a strict regex ^[0-9]+$ on the ID query argument.
Apply least-privilege database credentials so the web application account cannot read sensitive tables or execute DDL statements.

bash

# Example nginx workaround: reject non-numeric ID values on /details.php
location = /details.php {
    if ($arg_ID !~ "^[0-9]+$") {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}