CVE-2025-51567: Online Exam System SQLi Vulnerability

CVE-2025-51567 Overview

A SQL Injection vulnerability was discovered in the Kashipara Online Exam System V1.0. The vulnerability exists in the /exam/user/profile.php page, which allows remote attackers to execute arbitrary SQL commands and gain unauthorized access to the database. The vulnerable parameters include rname, rcollage, rnumber, rgender, and rpassword in POST HTTP requests.

Critical Impact

Remote attackers can execute arbitrary SQL commands to access, modify, or exfiltrate sensitive data from the database without authentication, potentially compromising student records, exam data, and user credentials.

Affected Products

• Kashipara Online Exam System V1.0
• Profile Update functionality (/exam/user/profile.php)
• Systems utilizing POST parameters: rname, rcollage, rnumber, rgender, rpassword

Discovery Timeline

• 2026-01-12 - CVE-2025-51567 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-51567

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from improper neutralization of special elements used in SQL commands. The profile update functionality in Kashipara Online Exam System fails to properly sanitize user-supplied input before incorporating it into SQL queries. When a user submits a profile update through a POST request, the parameters rname, rcollage, rnumber, rgender, and rpassword are directly concatenated into SQL statements without proper parameterization or input validation.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring prior authentication. Successful exploitation grants attackers the ability to read sensitive data from the database (high confidentiality impact) and modify existing records (high integrity impact), potentially leading to complete database compromise.

Root Cause

The root cause of this vulnerability is the lack of prepared statements or parameterized queries in the profile update functionality. The application directly concatenates user input from POST parameters into SQL queries, allowing attackers to inject malicious SQL syntax. This represents a fundamental secure coding failure where input validation and output encoding were not implemented.

Attack Vector

The attack is conducted over the network via HTTP POST requests to the /exam/user/profile.php endpoint. An attacker crafts malicious input containing SQL syntax and submits it through any of the vulnerable parameters (rname, rcollage, rnumber, rgender, or rpassword). The injected SQL commands are then executed by the database with the privileges of the application's database user.

Common attack patterns include using single quotes to break out of string contexts, UNION-based injections to extract data from other tables, and boolean-based blind SQL injection techniques to enumerate database contents when direct output is not visible.

Technical details and proof-of-concept information can be found in the GitHub Writeup for SQL Injection.

Detection Methods for CVE-2025-51567

Indicators of Compromise

• Unusual HTTP POST requests to /exam/user/profile.php containing SQL syntax characters such as single quotes, double dashes, or UNION keywords
• Database error messages appearing in application logs or responses indicating malformed SQL queries
• Unexpected database queries accessing tables beyond the profile table scope
• Anomalous data modifications in user profile records or other database tables

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect SQL injection patterns in POST parameters targeting the profile update endpoint
• Implement database activity monitoring to detect unusual query patterns, unauthorized table access, or bulk data extraction
• Configure application logging to capture and alert on database errors that may indicate injection attempts
• Use intrusion detection systems with SQL injection signature detection capabilities

Monitoring Recommendations

• Monitor web server access logs for repeated POST requests to /exam/user/profile.php with suspicious parameter values
• Enable database audit logging to track queries executed against sensitive tables
• Implement anomaly detection for database traffic patterns that deviate from normal application behavior
• Set up alerts for any database errors or exceptions originating from the profile update functionality

How to Mitigate CVE-2025-51567

Immediate Actions Required

• Restrict access to the profile update functionality (/exam/user/profile.php) until a patch is applied
• Implement input validation at the web server or WAF level to block SQL injection patterns
• Review database user privileges and apply principle of least privilege to limit potential damage
• Consider taking the Online Exam System offline if it contains sensitive data and cannot be adequately protected

Patch Information

No official vendor patch information is currently available for this vulnerability. Organizations using Kashipara Online Exam System V1.0 should contact the vendor for remediation guidance or implement the workarounds described below. For additional technical details, refer to the GitHub Writeup for SQL Injection.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious input before it reaches the application
• Implement server-side input validation to sanitize the rname, rcollage, rnumber, rgender, and rpassword parameters
• Restrict network access to the application to trusted IP ranges only using firewall rules
• If source code access is available, modify the profile update functionality to use prepared statements with parameterized queries

# Example WAF rule to block SQL injection patterns (ModSecurity)
SecRule ARGS "@rx (?i)(union.*select|select.*from|insert.*into|drop\s+table|--)" \
    "id:1001,phase:2,deny,status:403,msg:'SQL Injection Attempt Detected'"