CVE-2025-8239 is a critical SQL Injection vulnerability identified in version 1.0 of the 'Exam Form Submission' product developed by code-projects. The vulnerability resides in an unspecified functionality within the /admin/ directory, where the 'email' parameter is improperly sanitized, allowing an attacker to inject malicious SQL code. This flaw enables remote exploitation without requiring any authentication or user interaction, as indicated by the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N). The vulnerability impacts the confidentiality, integrity, and availability of the underlying database, potentially allowing attackers to extract sensitive data, modify or delete records, or disrupt service. Although the CVSS score is 6.9 (medium severity), the description classifies it as critical, reflecting the high risk typically associated with SQL injection vulnerabilities. No patches or fixes have been published yet, and no known exploits are currently observed in the wild. The public disclosure of the exploit increases the risk of active exploitation, especially on unpatched systems. The vulnerability affects only version 1.0 of the product, which is likely an application used for managing exam form submissions, possibly in educational or certification contexts. The lack of authentication requirement and ease of remote exploitation make this vulnerability particularly dangerous, as attackers can leverage it to compromise backend databases and extract or manipulate sensitive information without any prior access.

For European organizations, the impact of this vulnerability can be significant, especially for educational institutions, certification bodies, or any entities using the 'Exam Form Submission' software. Successful exploitation could lead to unauthorized access to personal data of students or candidates, including email addresses and possibly other sensitive information stored in the database. This could result in data breaches violating GDPR regulations, leading to legal penalties and reputational damage. Additionally, attackers could alter exam records or submission data, undermining the integrity of examination processes and causing operational disruptions. The availability of the affected service could also be impacted if attackers execute destructive SQL commands or cause database corruption. Given the remote, unauthenticated nature of the attack, threat actors could easily target vulnerable systems across Europe, increasing the risk of widespread compromise. The public disclosure of the exploit further elevates the threat level, as opportunistic attackers may attempt automated scanning and exploitation campaigns.

Organizations using code-projects Exam Form Submission 1.0 should immediately conduct a thorough audit of their systems to identify vulnerable instances. Since no official patch is currently available, temporary mitigations include implementing web application firewalls (WAFs) with specific rules to detect and block SQL injection attempts targeting the 'email' parameter in the /admin/ path. Input validation and sanitization should be enforced at the application level, ensuring that all user-supplied data is properly escaped or parameterized before database queries. Restricting access to the /admin/ directory via IP whitelisting or VPN-only access can reduce exposure. Monitoring logs for suspicious activity related to SQL injection patterns is critical to detect exploitation attempts early. Organizations should engage with the vendor for patch timelines and plan for prompt application of updates once released. Additionally, conducting security awareness training for administrators to recognize and respond to potential incidents is recommended. Backup strategies should be reviewed and tested to ensure rapid recovery in case of data corruption or loss.