CVE-2025-13564
📋 TL;DR
CVE-2025-13564 is an arbitrary file deletion vulnerability in SourceCodester Pre-School Management System 1.0. Attackers can remotely manipulate the filepath parameter in the removefile function to delete arbitrary files, causing denial of service. Organizations using this specific version of the software are affected.
💻 Affected Systems
- SourceCodester Pre-School Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Critical system files could be deleted, causing complete system unavailability, data loss, or requiring full system restoration from backups.
Likely Case
Attackers delete application files, configuration files, or user data, causing service disruption and requiring file restoration.
If Mitigated
With proper file permissions and monitoring, impact is limited to non-critical files with minimal service disruption.
🎯 Exploit Status
Public exploit available on GitHub. Remote exploitation without authentication is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to restrict filepath parameter to allowed directories only
Modify app/controllers/FilehelperController.php to validate filepath against whitelist
File Permission Restrictions
linuxSet strict file permissions to limit what files the web server user can delete
chmod 644 for files, chmod 755 for directories, restrict web server user permissions
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests with suspicious filepath parameters
- Restrict network access to the application using firewall rules or network segmentation
🔍 How to Verify
Check if Vulnerable:
Check if running SourceCodester Pre-School Management System version 1.0 by examining version files or application metadataCheck Version:
Check version.txt or similar files in application directory, or examine PHP application headersVerify Fix Applied:
Test the removefile endpoint with malicious filepath parameters to ensure proper validation📡 Detection & Monitoring
Log Indicators:
- HTTP requests to FilehelperController.php with unusual filepath parameters
- File deletion errors in application logs
- 404 errors for unexpectedly missing files
Network Indicators:
- HTTP POST requests to removefile endpoint with directory traversal patterns
- Unusual file deletion patterns from web server IP
SIEM Query:
source="web_logs" AND uri="/app/controllers/FilehelperController.php" AND (filepath CONTAINS ".." OR filepath CONTAINS "/etc" OR filepath CONTAINS "/root")