CVE-2025-9238

Root

Cause

A SQL injection vulnerability exists in the email parameter of the /student.php login form in the Swatadru Exam-Seating-Arrangement application. User input is directly concatenated into SQL queries without prepared statements or input validation, allowing an attacker to manipulate the query [1][2]. The product uses rolling releases, so specific affected versions are not identified, but the issue was confirmed in the latest tested commit up to 97335ccebf95468d92525f4255a2241d2b0b002f.

Exploitation

The attack is remotely exploitable without authentication. An attacker submits a malicious payload in the email parameter, such as admin@gmail.com', which breaks out of the query's syntax [1]. Tools like SQLMap can automate database enumeration and exploitation using a captured HTTP POST request [1]. The vendor was contacted but did not respond [1].

Impact

Successful exploitation can lead to authentication bypass (including admin-level access), exfiltration of sensitive student and exam data, modification or deletion of database contents, and potential escalation to full server compromise depending on database privileges [1].

Mitigation

As of the disclosure date, no official patch or advisory has been released. Users are advised to immediately apply input validation, use parameterized queries or prepared statements, and monitor the repository for future updates. The vulnerability is publicly documented with working proof-of-concept code and is listed on no known KEV at this time.