CVE-2025-15050
Unrestricted File Upload in Student File Management System
Publication date: 2025-12-24
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| code-projects | student_file_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15050 is an arbitrary file upload vulnerability in the Student File Management System version 1.0, specifically affecting the /save_file.php script. It allows attackers, including unauthenticated remote attackers, to upload files without proper validation or authorization. This flaw arises from improper handling of the file upload process, enabling attackers to upload malicious files such as web shells. These malicious files can lead to full server compromise, unauthorized access, and potential manipulation or leakage of sensitive data. [1, 2, 3, 4]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including full server compromise through the upload of malicious files like web shells. Attackers can remotely exploit this flaw to execute arbitrary code, gain unauthorized access, manipulate or access sensitive user data, and disrupt the confidentiality, integrity, and availability of the system. The vulnerability is easy to exploit remotely and has a moderate severity score, making affected systems attractive targets for attackers. [1, 2, 3, 4]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for HTTP POST requests to the /save_file.php endpoint that include file upload attempts, especially those with suspicious or unexpected file types such as PHP files disguised as images. You can use network traffic analysis tools or web server logs to identify such requests. Additionally, Google Hacking techniques like searching for 'inurl:save_file.php' can help identify vulnerable targets externally. A practical detection command example using curl to test the upload endpoint could be: curl -X POST -F "[email protected]" http://target/save_file.php -v. Monitoring for unusual file uploads or new files in the upload directory on the server can also help detect exploitation attempts. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting access to the /save_file.php upload functionality to prevent unauthorized file uploads. Since no known countermeasures or patches are documented, it is recommended to replace the affected Student File Management System version 1.0 with an alternative product that does not have this vulnerability. Additionally, implementing strict input validation and sanitization on file uploads, restricting allowed file types, and enforcing authentication and authorization checks can help mitigate the risk. Monitoring and removing any suspicious uploaded files and applying web application firewall (WAF) rules to block malicious upload attempts are also advisable. [2, 4]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA. However, given that the vulnerability allows arbitrary file uploads, potential server compromise, and unauthorized access to sensitive data, it could lead to violations of data protection requirements under such regulations by exposing or compromising personal or sensitive information. [1, 2, 3, 4]