CVE-2025-45997
📋 TL;DR
This vulnerability allows attackers to upload malicious PHP files disguised as images to the Web-based Pharmacy Product Management System v1.0. By modifying the Content-Type header to image/jpg, attackers can bypass file upload restrictions and potentially execute arbitrary code on the server. Organizations using this specific version of the pharmacy management system are affected.
💻 Affected Systems
- Sourcecodester Web-based Pharmacy Product Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, ransomware deployment, or complete system takeover through remote code execution.
Likely Case
Webshell installation allowing persistent backdoor access, data exfiltration, and lateral movement within the network.
If Mitigated
File upload attempts blocked at the web application firewall level with no successful exploitation.
🎯 Exploit Status
Exploitation requires only HTTP request manipulation and basic web testing tools. The GitHub POC demonstrates the exact technique.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch exists. Consider replacing with alternative software or implementing workarounds.
🔧 Temporary Workarounds
File Upload Validation Enhancement
allImplement server-side file validation that checks both file extension and MIME type, and validates actual file content rather than trusting headers.
Web Application Firewall Rules
allConfigure WAF to block file uploads with PHP extensions or suspicious Content-Type manipulation.
🧯 If You Can't Patch
- Disable file upload functionality entirely in the application
- Implement strict file upload directory permissions and disable PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a PHP file with Content-Type: image/jpg header to the file upload endpoint. If successful, the system is vulnerable.Check Version:
Check the application's version.php file or admin panel for version information.Verify Fix Applied:
Attempt the same upload test after implementing fixes. The upload should be rejected with proper validation errors.📡 Detection & Monitoring
Log Indicators:
- Multiple failed file upload attempts
- Successful uploads of files with mismatched extensions and content types
- Access to uploaded PHP files in unexpected directories
Network Indicators:
- HTTP POST requests to upload endpoints with manipulated Content-Type headers
- Traffic to newly created PHP files in upload directories
SIEM Query:
source="web_logs" AND (uri_path="*upload*" OR uri_path="*.php") AND (http_method="POST" AND content_type="image/*" AND user_agent LIKE "%curl%" OR "%wget%")