CVE-2025-11078
📋 TL;DR
CVE-2025-11078 is an unrestricted file upload vulnerability in itsourcecode Open Source Job Portal 1.0 that allows remote attackers to upload arbitrary files via the /admin/user/controller.php?action=photos endpoint. This affects all deployments of version 1.0 that have the vulnerable functionality enabled, potentially leading to server compromise.
💻 Affected Systems
- itsourcecode Open Source Job Portal
📦 What is this software?
Open Source Job Portal by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and persistent backdoor installation.
Likely Case
Webshell upload enabling unauthorized access, file manipulation, and potential lateral movement within the network.
If Mitigated
Limited impact with proper file upload restrictions, though system integrity may still be at risk.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Restrict file upload functionality
allImplement strict file type validation and size limits for uploads via the photos endpoint.
Modify /admin/user/controller.php to validate file extensions and MIME types
Disable vulnerable endpoint
allTemporarily disable or restrict access to /admin/user/controller.php?action=photos
Add authentication requirement or IP restriction to the endpoint
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Restrict network access to the vulnerable endpoint using firewall rules
🔍 How to Verify
Check if Vulnerable:
Test if you can upload arbitrary files (e.g., .php, .exe) to /admin/user/controller.php?action=photosCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify that file upload restrictions are enforced and only allowed file types can be uploaded📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/user/controller.php
- Uploads of executable file types
- Multiple failed upload attempts
Network Indicators:
- POST requests to /admin/user/controller.php?action=photos with file uploads
- Unusual outbound connections after file uploads
SIEM Query:
source="web_logs" AND uri="/admin/user/controller.php" AND action="photos" AND file_upload="true"