CVE-2025-11351
📋 TL;DR
CVE-2025-11351 is an unrestricted file upload vulnerability in code-projects Online Hotel Reservation System 1.0. Attackers can upload malicious files via the /admin/editpicexec.php endpoint, potentially leading to remote code execution. This affects all deployments of version 1.0 of this hotel reservation software.
💻 Affected Systems
- code-projects Online Hotel Reservation System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and installation of persistent backdoors.
Likely Case
Webshell upload allowing unauthorized access to the server, file manipulation, and potential lateral movement.
If Mitigated
File upload blocked or sanitized, preventing malicious file execution.
🎯 Exploit Status
Exploit requires admin access to reach /admin/editpicexec.php endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacing software.
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file upload validation in PHP configuration or web server.
# In php.ini: file_uploads = Off
# Or restrict in .htaccess: php_flag file_uploads off
Access Control
allRestrict access to /admin/editpicexec.php using IP whitelisting or authentication.
# In .htaccess: Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file uploads to vulnerable endpoint
- Monitor file upload activity and implement file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check if /admin/editpicexec.php exists and accepts file uploads without proper validation.Check Version:
Check software version in admin panel or readme files.Verify Fix Applied:
Attempt to upload a malicious file (e.g., .php file) and verify it's blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- File uploads to /admin/editpicexec.php
- Execution of uploaded files with suspicious extensions
Network Indicators:
- POST requests to /admin/editpicexec.php with file upload content
SIEM Query:
source="web_logs" AND uri="/admin/editpicexec.php" AND method="POST" AND content_type="multipart/form-data"