Cyber Resilience

CVE-2025-28087

CriticalPublic PoC

Published: 28 March 2025

Published
28 March 2025
Modified
07 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 34.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28087 is a critical-severity SQL Injection (CWE-89) vulnerability in Nayem-Howlader Online Exam System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-28087 is a SQL injection vulnerability (CWE-89) in Sourcecodester Online Exam System 1.0, exploitable via the dash.php component. Published on 2025-03-28T22:15:17.717, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.

Remote attackers require only network access and can exploit the vulnerability with low attack complexity, no privileges, and no user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, allowing arbitrary SQL query execution against the underlying database.

Advisories with further details, including potential mitigation guidance, are available at https://www.yuque.com/morysummer/vx41bz/vxhdpdeavzvtvdqq.

EU & UK References

Vulnerability details

Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing web app (dash.php) directly matches T1190 for remote exploitation of public-facing applications without auth.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89
CVE-2025-22691Shared CWE-89

Affected Assets

nayem-howlader
online exam system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection by requiring validation of untrusted inputs to the dash.php component before processing in SQL queries.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of flaws like the SQL injection vulnerability in Sourcecodester Online Exam System 1.0 to prevent exploitation.

SC-7 Boundary Protection partial match
prevent

Boundary protection with web application firewalls can inspect and block SQL injection payloads targeting dash.php.

References