CVE-2025-10081
BaseFortify
Publication date: 2025-09-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mayuri_k | pet_grooming_management_software | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10081 is an Unrestricted File Upload vulnerability in the SourceCodester Pet Management System version 1.0, specifically in the admin/profile.php module. An authenticated attacker can exploit this flaw by manipulating the 'website_image' parameter to upload arbitrary files, including malicious PHP scripts, bypassing client-side restrictions that only allow image files. Because the server does not perform proper validation or sanitization of uploaded files, the attacker can upload a web shell and execute arbitrary code remotely on the hosting server, leading to Remote Code Execution (RCE). [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including allowing an authenticated attacker to execute arbitrary code on the server hosting the Pet Management System. This can lead to full compromise of the server, unauthorized access to sensitive data, modification or deletion of data, disruption of service, and potentially using the server as a pivot point for further attacks within the network. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of unauthorized or suspicious files, such as PHP web shells, in the upload directory /petgrooming_erp/pet_grooming/assets/uploadImage/Profile/. You can look for files with .php extensions or unusual filenames in that directory. Additionally, monitoring HTTP requests to the admin/profile.php endpoint for file upload activity and suspicious parameters like website_image can help detect exploitation attempts. A simple command to find potentially malicious uploaded files is: find /path/to/petgrooming_erp/pet_grooming/assets/uploadImage/Profile/ -type f -name '*.php'. Also, reviewing web server logs for requests to URLs like /assets/uploadImage/Profile/*.php?cmd= can indicate exploitation. Since the vulnerability requires authentication, checking for unusual authenticated sessions or changes in profile images may also help. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the upload directory to prevent execution of uploaded files, for example by disabling PHP execution in the /assets/uploadImage/Profile/ directory via web server configuration. Also, restrict file types allowed for upload on the server side by validating file extensions, MIME types, and file contents before saving. Applying strict authentication and monitoring for suspicious upload activity is important. If possible, update or patch the application to a fixed version or replace the affected product. As a temporary measure, removing or restricting access to the vulnerable admin/profile.php functionality can reduce risk. [2, 3]