CVE-2025-10480
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to SourceCodester Online Student File Management System 1.0 via the /save_file.php endpoint. Successful exploitation could lead to remote code execution or system compromise. All deployments of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Online Student File Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Webshell upload enabling persistent access, data exfiltration, or lateral movement
If Mitigated
File upload blocked, but system remains vulnerable to other attack vectors
🎯 Exploit Status
Public exploit available on GitHub. Attack requires no authentication and minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing the software.
🔧 Temporary Workarounds
Block /save_file.php access
allRestrict access to the vulnerable endpoint using web server configuration
# Apache: <Location "/save_file.php"> Require all denied </Location>
# Nginx: location = /save_file.php { deny all; }
Implement file upload validation
phpAdd server-side validation for file types, extensions, and content
# Example PHP validation snippet: if(!in_array($file_ext, ['pdf','doc','txt'])) { die('Invalid file type'); }
🧯 If You Can't Patch
- Implement WAF rules to block malicious file uploads
- Isolate the system in a restricted network segment
- Implement strict file integrity monitoring on upload directories
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a file with malicious extension (e.g., .php) to /save_file.php endpointCheck Version:
Check system version in admin panel or readme filesVerify Fix Applied:
Verify file upload restrictions are working by testing with various file types📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /save_file.php
- Uploads of executable file types (.php, .exe, .sh)
- Large file uploads or unusual file names
Network Indicators:
- Unusual traffic patterns to /save_file.php
- POST requests with file uploads from unexpected sources
SIEM Query:
source="web_logs" AND uri="/save_file.php" AND (file_extension="php" OR file_extension="exe" OR file_extension="sh")