CVE-2025-3764
📋 TL;DR
This critical vulnerability in SourceCodester Web-based Pharmacy Product Management System 1.0 allows remote attackers to upload arbitrary files via the Avatar parameter in /edit-product.php. This can lead to complete system compromise through web shell deployment. All installations of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Web-based Pharmacy Product Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via web shell leading to data theft, ransomware deployment, or complete server takeover
Likely Case
Web shell installation enabling persistent backdoor access, data exfiltration, and lateral movement
If Mitigated
Limited impact with proper file upload restrictions and web application firewalls in place
🎯 Exploit Status
Public exploit code available on GitHub. Simple file upload manipulation required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider removing the system or implementing workarounds.
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file type validation and extension filtering for uploads
Modify /edit-product.php to validate file extensions and MIME types
Web Application Firewall Rules
allBlock malicious file upload patterns at the WAF level
Add WAF rule: deny requests to /edit-product.php with suspicious file extensions
🧯 If You Can't Patch
- Remove or disable /edit-product.php endpoint completely
- Implement network segmentation to isolate the vulnerable system from critical assets
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a file with malicious extension (e.g., .php, .jsp) to /edit-product.php via Avatar parameterCheck Version:
Check system version in admin panel or readme filesVerify Fix Applied:
Test that file uploads are properly restricted and malicious files are rejected📡 Detection & Monitoring
Log Indicators:
- Multiple file upload attempts to /edit-product.php
- Uploads of executable file types (.php, .jsp, .asp)
Network Indicators:
- POST requests to /edit-product.php with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND uri="/edit-product.php" AND method="POST" AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp")