CVE-2025-3783
📋 TL;DR
This critical vulnerability in SourceCodester Web-based Pharmacy Product Management System 1.0 allows remote attackers to upload arbitrary files via the Avatar parameter in /add-product.php. This can lead to complete system compromise through web shell deployment. All installations of version 1.0 are affected.
💻 Affected Systems
- SourceCodester Web-based Pharmacy Product Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via web shell leading to data theft, ransomware deployment, or complete system takeover
Likely Case
Web shell installation enabling backdoor access, data exfiltration, and lateral movement within the network
If Mitigated
Limited impact if file uploads are restricted to authenticated users with proper file type validation
🎯 Exploit Status
Public exploit available on GitHub. Simple file upload bypass technique documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates. Consider implementing workarounds or replacing the software.
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file type validation and whitelist allowed extensions for uploads
Modify /add-product.php to validate file extensions and MIME types before saving
Authentication Requirement
allRequire authentication before allowing file uploads
Add session validation at the beginning of /add-product.php
🧯 If You Can't Patch
- Block access to /add-product.php via web application firewall or .htaccess
- Implement network segmentation to isolate the vulnerable system from critical assets
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a file with .php extension via /add-product.php Avatar parameter. If successful, system is vulnerable.Check Version:
Check system version in admin panel or footer. Look for 'Web-based Pharmacy Product Management System 1.0'Verify Fix Applied:
Test file upload with restricted extensions. PHP files should be rejected with proper error messages.📡 Detection & Monitoring
Log Indicators:
- Multiple failed upload attempts with unusual file extensions
- Successful upload of .php, .phtml, or other executable files
- Access to /add-product.php from unusual IP addresses
Network Indicators:
- POST requests to /add-product.php with file uploads
- Subsequent requests to uploaded files with suspicious parameters
SIEM Query:
source="web_logs" AND (uri="/add-product.php" AND method="POST") AND (file_extension="php" OR file_extension="phtml" OR file_extension="jsp")🔗 References
- https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/upload_in_add-product.md
- https://vuldb.com/?ctiid.305605
- https://vuldb.com/?id.305605
- https://vuldb.com/?submit.553723
- https://www.sourcecodester.com/
- https://github.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/upload_in_add-product.md
