CVE-2025-4720
📋 TL;DR
A path traversal vulnerability in SourceCodester Student Result Management System 1.0 allows attackers to access arbitrary files on the server by manipulating the 'img' parameter in academic/core/drop_student.php. This affects all installations of version 1.0 that expose the vulnerable component. Remote attackers can potentially read sensitive system files.
💻 Affected Systems
- SourceCodester Student Result Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files (database credentials, system files) leading to data theft, privilege escalation, or further attacks.
Likely Case
Unauthorized reading of application files, configuration files, or other sensitive data stored on the web server.
If Mitigated
Limited impact if file permissions are properly restricted and sensitive files are stored outside web root.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Simple HTTP requests with path traversal sequences can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation to the drop_student.php file to restrict 'img' parameter to allowed values only
Edit academic/core/drop_student.php to validate the img parameter against a whitelist of allowed files
Web Server File Restriction
allConfigure web server to restrict access to sensitive directories and files
For Apache: Add 'Deny from all' to .htaccess in sensitive directories
For Nginx: Add location blocks to restrict file access
🧯 If You Can't Patch
- Remove or disable the academic/core/drop_student.php file if not required
- Implement web application firewall (WAF) rules to block path traversal patterns
🔍 How to Verify
Check if Vulnerable:
Test by accessing academic/core/drop_student.php?img=../../../etc/passwd (or similar traversal) and checking if sensitive files are returnedCheck Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Attempt the same path traversal attack after implementing fixes - should return error or empty response📡 Detection & Monitoring
Log Indicators:
- HTTP requests to drop_student.php with '..' sequences in parameters
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests containing path traversal sequences (%2e%2e%2f or ../)
SIEM Query:
web.url:*drop_student.php* AND (web.param:*..* OR web.param:*%2e%2e*)