CVE-2025-11508
📋 TL;DR
This vulnerability in code-projects Voting System 1.0 allows remote attackers to upload arbitrary files via the photo parameter in /admin/voters_add.php. This can lead to server compromise through malicious file execution. All deployments of Voting System 1.0 with the vulnerable file accessible are affected.
💻 Affected Systems
- code-projects Voting System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, file manipulation, and potential privilege escalation.
If Mitigated
Limited to file storage exhaustion or temporary service disruption if uploads are properly sandboxed.
🎯 Exploit Status
Public exploit available on GitHub. Simple file upload manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Restrict file uploads
PHPImplement strict file type validation and size limits for photo uploads
Modify /admin/voters_add.php to validate file extensions (allow only: .jpg, .jpeg, .png, .gif)
Add file size limit check (e.g., max 2MB)
Implement file content validation using PHP's finfo_file()
Disable vulnerable endpoint
allTemporarily disable or restrict access to the vulnerable file
Rename /admin/voters_add.php to /admin/voters_add.php.disabled
Add .htaccess restriction: Deny from all
Implement IP-based access control
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Isolate the voting system in a restricted network segment with no internet access
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a file with PHP extension (e.g., test.php) to /admin/voters_add.php. If accepted, system is vulnerable.Check Version:
Check software version in admin panel or readme filesVerify Fix Applied:
Test that only allowed image file types are accepted and PHP/executable files are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/voters_add.php
- Uploads of non-image file types
- Multiple failed upload attempts
Network Indicators:
- POST requests to /admin/voters_add.php with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND uri="/admin/voters_add.php" AND method="POST" AND (file_extension="php" OR file_extension="exe" OR file_extension="sh")