CVE-2025-12327

MediumCVSS 6.3

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

In RUET OJ (shawon100 project) up to version 18fa45b0a669fa1098a0b8fc629cf6856369d9a5, there is an SQL injection vulnerability in /description.php via manipulation of the ID argument. The attack can be initiated remotely, and the exploit has been publicly disclosed. The product uses a rolling release model, so specific affected or fixed versions are not available.

Risk Assessment

The vulnerability allows remote attacks that could lead to unauthorized database access, data leakage, or modification. Lack of vendor response increases risk.

Recommendation

Immediately restrict access to the system, deploy a WAF, and monitor traffic for SQL injection attempts. Contact the vendor for fixes.

Other vulnerabilities in RUET OJ

CVE-2025-12328Medium
A SQL injection vulnerability was identified in shawon100 RUET OJ within the file /contestproblem.php, triggered by manipulation of the Name argument. The attack can be launched remotely, and a publicly available exploit might be used. The product operates on a rolling release basis, so no version details are available.

Original NVD description (English source)

A vulnerability was determined in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This issue affects some unknown processing of the file /description.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS