CVE-2025-8331 is a high severity SQL injection flaw (CVSS 7.3) in code-projects Online Farm System 1.0. The email input handled by /forgot_pass.php reaches a database query without proper neutralization. No fixed version is confirmed, so remove the app from public exposure or patch the query yourself.
What's affected
Affected: code-projects Online Farm System, version 1.0, per the NVD record. The weak spot is /forgot_pass.php, where the email parameter is used in a database query. The record adds that other parameters might be affected as well, so treat the whole file as suspect and not only that one input.
The record scores this 7.3 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The CNA description (VulDB) calls it "critical", which is VulDB's own rating wording and not the CVSS band. Both are stated here; this post uses the CVSS score.
Fixed versions: none confirmed. The sources I reviewed (a public GitHub issue from the reporter and the NVD record) do not name a patched release or a vendor advisory. Check the vendor or project site for a newer release before assuming a fix exists.
The record lists the weakness as CWE-74 and CWE-89 (SQL injection). Gold has the full entry for CVE-2025-8331.
Exploitation status: the record says the exploit details have been disclosed publicly and could be used. CVE-2025-8331 is not listed in the CISA Known Exploited Vulnerabilities catalog per the record, and none of the pages I read claims exploitation in the wild.
How to check if you're exposed
This is a source-distributed PHP style project, so there is no package manager entry to query. Look for the app on your own servers.
# find copies of the affected file under your web roots
find /var/www -type f -path "*forgot_pass.php" 2>/dev/null
# see how the email value is used in that file
grep -n "email" $(find /var/www -type f -path "*forgot_pass.php" 2>/dev/null)
If a query is built by joining the request value into a string, the file matches the pattern the record describes. If the query uses prepared statements with bound parameters, that code path is not the one described. Also look in your reverse proxy and database logs for odd quote characters or SQL keywords in requests to /forgot_pass.php.
Ask whoever installed it too. These apps are often downloaded as sample projects and deployed once, then forgotten. A free dependency scan covers the libraries in a repository, but a flaw in the project's own code like this one needs a code review or a static analysis pass.
What to do now
- Take the app off the public internet or put it behind a login, VPN or IP allow list. The record says the attack can be launched remotely.
- Check the vendor site for a newer release than 1.0. If you find one, read its notes before upgrading, because none of the sources I read confirms a fix.
- If you maintain the code, change the query in
/forgot_pass.phpto use prepared statements with bound parameters foremailand every other request value in the file. - Run the database account for the app with the fewest rights it needs. It should not own the schema or reach other databases.
- Review web server and database logs for unusual requests to the file since the public disclosure date, and rotate any credentials stored in that database if you see signs of probing.
A defensive pattern for PHP code looks like this. It is a general fix, not a patch from the vendor.
$stmt = $pdo->prepare("SELECT * FROM items WHERE id = :id");
$stmt->execute([":id" => $_POST["id"]]);
$rows = $stmt->fetchAll();
Why it matters
SQL injection happens when a request value becomes part of the query text and not just data. The database then cannot tell the developer's instructions from the visitor's input. The record maps this to CWE-74 and CWE-89. Depending on the app, that can expose records, change them, or break the app. The vector here rates confidentiality, integrity and availability impact as low each, and needs no login and no user action.
The product is a small sample style app, which is a pattern worth noticing. Many of these projects get deployed by students, small shops and internal teams, and then they sit unmaintained. The record references a public report on GitHub, and none of the sources I reviewed shows a vendor advisory. That is why exposure control and code level fixes matter more than waiting for a release.
Quick check
Is there a patched version of Online Farm System?
None is confirmed in the sources reviewed. The NVD record lists 1.0 as affected, and no vendor advisory was found. Check the vendor site before relying on any fix.
Is CVE-2025-8331 being exploited in the wild?
The record does not mark it as a known exploited vulnerability, and no advisory I read says so. The record does say exploit details were disclosed publicly, so assume that attackers can reproduce it.
Sources
- Safeguard Gold entry for CVE-2025-8331
- NVD record data for CVE-2025-8331, published 2025-07-30, CVSS 7.3
- Public GitHub issue from the reporter (third party report, read 18 October 2026)
Last reviewed: 18 October 2026.
