CVE-2025-8174
📋 TL;DR
This critical vulnerability in code-projects Voting System 1.0 allows remote attackers to upload arbitrary files via the photo parameter in /admin/candidates_add.php. This can lead to remote code execution or system compromise. Organizations using this voting system software are affected.
💻 Affected Systems
- code-projects Voting System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system takeover, data theft, or deployment of ransomware.
Likely Case
Webshell upload enabling persistent access, data manipulation, or lateral movement within the network.
If Mitigated
File upload blocked or restricted to safe extensions only, preventing exploitation.
🎯 Exploit Status
Exploit details are publicly disclosed and trivial to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative software or implementing workarounds.
🔧 Temporary Workarounds
Restrict file upload extensions
allModify candidates_add.php to only allow image file extensions (jpg, png, gif) and validate file type.
Edit /admin/candidates_add.php to add file extension validation
Disable file upload functionality
allTemporarily disable the photo upload feature in the voting system.
Comment out or remove file upload code in candidates_add.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Restrict access to /admin/ directory to trusted IP addresses only
🔍 How to Verify
Check if Vulnerable:
Check if /admin/candidates_add.php exists and accepts file uploads without proper validation.Check Version:
Check application version in source code or documentation.Verify Fix Applied:
Attempt to upload a non-image file (e.g., .php, .exe) and verify it's rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/candidates_add.php
- Uploads of non-image file types
Network Indicators:
- POST requests to /admin/candidates_add.php with file uploads
- Subsequent requests to uploaded malicious files
SIEM Query:
source="web_server" AND uri="/admin/candidates_add.php" AND method="POST" AND file_upload="true"