CVE-2025-7151
📋 TL;DR
This critical vulnerability in Campcodes Advanced Online Voting System 1.0 allows remote attackers to upload arbitrary files via the photo parameter in the /admin/voters_add.php endpoint. This can lead to remote code execution or system compromise. All deployments of version 1.0 are affected.
💻 Affected Systems
- Campcodes Advanced Online Voting System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, and deployment of persistent backdoors.
Likely Case
Webshell upload enabling unauthorized access, data manipulation, and further lateral movement within the system.
If Mitigated
File upload blocked, preventing exploitation while maintaining system functionality.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Simple HTTP POST request with malicious file upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock file uploads to /admin/voters_add.php endpoint
WAF specific - configure rule to block POST requests to /admin/voters_add.php with file upload content
File Upload Restriction
linuxModify PHP configuration to restrict file uploads
Modify php.ini: file_uploads = Off
Or restrict in .htaccess: php_value file_uploads Off
🧯 If You Can't Patch
- Disable the /admin/voters_add.php endpoint completely via web server configuration
- Implement strict file type validation and store uploaded files outside web root
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file (e.g., test.txt) to /admin/voters_add.php with photo parameter. If accepted without validation, system is vulnerable.Check Version:
Check system documentation or admin panel for version information. Default installations show version 1.0.Verify Fix Applied:
Attempt same upload test - should be rejected with proper error message or blocked entirely.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /admin/voters_add.php with file uploads
- Unusual file extensions (.php, .jsp, .asp) in upload logs
- Large number of failed/successful upload attempts
Network Indicators:
- HTTP POST requests to vulnerable endpoint with multipart/form-data
- Unusual outbound connections from web server after upload
SIEM Query:
source="web_logs" AND uri="/admin/voters_add.php" AND method="POST" AND content_type="multipart/form-data"