CVE-2025-13573
📋 TL;DR
This vulnerability allows remote attackers to upload malicious files via the /add_book.php endpoint in projectworlds can pass software up to version 1.0. Attackers can exploit this unrestricted file upload flaw to potentially execute arbitrary code on affected systems. Any system running vulnerable versions with the /add_book.php endpoint accessible is at risk.
💻 Affected Systems
- projectworlds can pass
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network
Likely Case
Webshell deployment allowing persistent backdoor access, file system manipulation, and potential data exfiltration
If Mitigated
Limited impact with proper file upload restrictions, web application firewalls, and network segmentation in place
🎯 Exploit Status
Public exploit available on GitHub, simple file upload manipulation required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider removing or replacing vulnerable software.
🔧 Temporary Workarounds
Restrict file uploads
allImplement strict file type validation and size limits for uploads
# In PHP configuration or application code
# Example: Restrict to specific file types
$allowed_types = ['jpg', 'png', 'gif'];
$file_extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_types)) {
die('Invalid file type');
}
Disable vulnerable endpoint
linuxRemove or restrict access to /add_book.php
# Apache .htaccess
RewriteRule ^add_book\.php$ - [F,L]
# Nginx configuration
location ~ /add_book\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Isolate affected systems in segmented network zones with strict egress filtering
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a file with malicious extension to /add_book.php endpoint and check if it's acceptedCheck Version:
Check software version in configuration files or admin interfaceVerify Fix Applied:
Test file upload with restricted types and verify proper validation is enforced📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /add_book.php
- Uploads of non-image file types
- Large number of upload requests
Network Indicators:
- POST requests to /add_book.php with executable file extensions
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND uri="/add_book.php" AND (file_extension="php" OR file_extension="exe" OR file_extension="sh")