CVE-2025-14641
BaseFortify
Publication date: 2025-12-14
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| carmelo | computer_laboratory_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw in the code-projects Computer Laboratory System 1.0, specifically in the file admin/admin_pic.php. It allows an attacker to manipulate the 'image' argument to perform an unrestricted file upload. This means an attacker can remotely upload files without proper restrictions, potentially leading to unauthorized actions.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing an attacker to upload arbitrary files remotely, which could lead to unauthorized access, data modification, or disruption of service. This could compromise the confidentiality, integrity, and availability of the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable file admin/admin_pic.php on your system or web server. Additionally, you can search for signs of arbitrary file uploads or suspicious files in the uploads/ directory, especially files with double extensions (e.g., shell.php.jpg) or files that could be web-executable scripts. You can also use Google dorking with queries like inurl:admin/admin_pic.php to identify exposed instances. Commands to detect suspicious files on the server might include: 1) find uploads/ -type f -name "*.php*" 2) grep -r "move_uploaded_file" /path/to/code-projects/ 3) checking web server logs for unusual POST requests to admin/admin_pic.php. These steps help identify if the vulnerable upload functionality is present and if it has been exploited. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the admin/admin_pic.php upload functionality to prevent unauthorized file uploads. Since no known countermeasures or patches are currently available, it is recommended to replace the affected component with an alternative product or apply custom security controls such as implementing strict file type validation, sanitizing filenames, and disabling execution permissions in the uploads directory. Additionally, monitor the uploads directory for suspicious files and remove any unauthorized uploads. Restricting access to the uploads directory and applying web server configuration to prevent execution of uploaded scripts can also reduce risk. [2, 1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.