Listen to this Post
How the CVE-2025-14203 Works
The vulnerability is a classic SQL injection flaw in the `code-projects Question Paper Generator` software, affecting all versions up to 1.0. The issue resides in the `/selectquestionuser.php` file. This script takes user input from the `subid` parameter, which is intended to specify a subject ID for querying the database for questions. The application fails to properly sanitize or validate this input before incorporating it into an SQL command. An attacker can send a specially crafted HTTP request to this accessible endpoint, embedding malicious SQL code within the `subid` parameter. Because the input is not neutralized, the database interprets the attacker’s payload as part of the legitimate SQL query rather than as simple data. This allows the attacker to manipulate the original database command. The exploit can be performed remotely over a network (AV:N) without requiring user interaction (UI:N). Successful exploitation can lead to the reading, modification, or deletion of data within the application’s database, impacting confidentiality and integrity. The public availability of an exploit script increases the risk of active attacks.
dailycve form
Platform: code-projects Question Paper Generator
Version: Up to 1.0
Vulnerability: SQL injection
Severity: HIGH (CVSS 8.8)
date: 2025-12-07
Prediction: No official patch
What Undercode Say:
Analytics
curl -X POST http://<target>/selectquestionuser.php -d "subid=' OR '1'='1"
Refer to public exploit: `https://github.com/asd1238525/cve/blob/main/SQL17.md`.
How Exploit:
Remote attacker sends crafted `subid` parameter. Malicious SQL bypasses authentication. Executes arbitrary database commands.
Protection from this CVE
Implement strict input validation. Use parameterized queries (prepared statements). Apply Web Application Firewall (WAF) rules. Restrict network access to application.
Impact:
Unauthorized database access. Data theft and manipulation. Potential exam paper compromise. Possible GDPR violation risks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
