CVE-2025-10081
📋 TL;DR
This vulnerability in SourceCodester Pet Management System 1.0 allows remote attackers to upload arbitrary files via the website_image parameter in /admin/profile.php, potentially leading to remote code execution. It affects all users running the default installation of this software. The exploit is publicly available, increasing the risk of exploitation.
💻 Affected Systems
- SourceCodester Pet Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or deployment of ransomware.
Likely Case
Unauthorized file upload resulting in web shell deployment, allowing attackers to execute commands on the server.
If Mitigated
Limited impact if file uploads are restricted to trusted sources and proper input validation is in place.
🎯 Exploit Status
Exploit code is available on GitHub, making it easy for attackers to use; exploitation typically requires admin access to the profile.php page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
Check the vendor website for updates or patches; if unavailable, consider workarounds or discontinuing use.
🔧 Temporary Workarounds
Restrict file uploads
allImplement server-side validation to allow only specific file types (e.g., images) and sanitize input for the website_image parameter.
Modify /admin/profile.php to include file type and extension checks before upload.
Disable or restrict access to /admin/profile.php
allLimit access to the vulnerable file using web server configurations or authentication mechanisms.
In Apache: <Location /admin/profile.php> Require valid-user </Location>
In Nginx: location /admin/profile.php { deny all; }
🧯 If You Can't Patch
- Monitor logs for unauthorized file upload attempts to /admin/profile.php.
- Isolate the system from the internet or place it behind a web application firewall (WAF) to block exploit attempts.
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file via the website_image parameter in /admin/profile.php; if successful, the system is vulnerable.Check Version:
Check the software version in the application's admin panel or configuration files.Verify Fix Applied:
After applying workarounds, test that file uploads are restricted to allowed types and access to /admin/profile.php is controlled.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/profile.php, especially with non-image extensions like .php or .exe.
Network Indicators:
- HTTP POST requests to /admin/profile.php with suspicious file content in the website_image parameter.
SIEM Query:
source="web_logs" AND url="/admin/profile.php" AND method="POST" AND (file_extension="php" OR file_extension="exe")