CVE-2025-15404
BaseFortify
Publication date: 2026-01-01
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| campcodes | school_file_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15404 is a critical unrestricted file upload vulnerability in campcodes School File Management System version 1.0. It exists in the /save_file.php file where improper handling of the 'file' argument allows an attacker to upload files without any restriction or validation. This means attackers can upload arbitrary and potentially dangerous files that the system may automatically process, leading to security risks. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can severely impact the confidentiality, integrity, and availability of the affected system. Attackers can upload malicious files that may be executed or processed by the system, potentially leading to remote code execution (RCE). This allows attackers to execute arbitrary code on the server, compromise sensitive data, disrupt system operations, and gain unauthorized access. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for the presence of the vulnerable endpoint /save_file.php in the campcodes School File Management System version 1.0. One method is to use Google dorking with queries like "inurl:save_file.php" to locate potentially vulnerable targets. Additionally, monitoring web server logs for unusual POST requests to /save_file.php that include file upload attempts can help detect exploitation attempts. Commands such as using curl to test file upload functionality can be used, for example: curl -X POST -F "[email protected]" http://target/save_file.php to see if the system accepts unrestricted file uploads. [3]
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations currently exist for this vulnerability. It is suggested to replace the affected component (campcodes School File Management System version 1.0) with an alternative product. Until a patch or fix is available, restricting access to the vulnerable endpoint /save_file.php and monitoring for suspicious activity may help reduce risk. [3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA. However, since the vulnerability allows unrestricted file uploads that can compromise confidentiality, integrity, and availability of the system, it could potentially lead to violations of data protection requirements under such regulations if sensitive data is exposed or systems are compromised. No direct statements about compliance impact are available. [1, 2, 3]