CVE-2025-13574
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to the Online Bidding System 1.0 administrator interface via the catimage parameter in the categoryadd function. Attackers can potentially upload malicious files like web shells to gain unauthorized access or execute code. Only systems running code-projects Online Bidding System 1.0 are affected.
💻 Affected Systems
- code-projects Online Bidding System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment via uploaded web shells or malicious executables.
Likely Case
Unauthorized file upload leading to defacement, data manipulation, or limited server access depending on file execution permissions.
If Mitigated
File upload blocked or restricted to safe types, preventing exploitation while maintaining functionality.
🎯 Exploit Status
Exploit details are publicly available on GitHub; requires administrator credentials to access the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates, consider workarounds, or replace with alternative software.
🔧 Temporary Workarounds
Restrict File Upload Types
allModify addcategory.php to validate file extensions and MIME types, allowing only safe image formats (e.g., .jpg, .png).
Edit /administrator/addcategory.php to add server-side validation for catimage uploads.
Disable Vulnerable Endpoint
linuxTemporarily block access to /administrator/addcategory.php via web server configuration or authentication.
# Apache: Add to .htaccess
<Files "addcategory.php">
Deny from all
</Files>
# Nginx: Add to server block
location /administrator/addcategory.php { deny all; }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the bidding system from critical assets.
- Deploy a web application firewall (WAF) with rules to block malicious file upload patterns.
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file (e.g., .php, .exe) via the /administrator/addcategory.php interface; if accepted, system is vulnerable.Check Version:
Check system documentation or admin panel for version info; default is 1.0.Verify Fix Applied:
Test file upload with restricted types; malicious files should be rejected with error messages.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /administrator/addcategory.php with non-image extensions
- Large or frequent uploads from single IPs
Network Indicators:
- HTTP POST requests to /administrator/addcategory.php with file uploads
- Anomalous outbound connections post-upload
SIEM Query:
source="web_logs" AND uri="/administrator/addcategory.php" AND method="POST" AND (file_extension="php" OR file_extension="exe")