CVE-2025-9153
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to the Online Tour and Travel Management System 1.0 via the photo parameter in /admin/operations/travellers.php. This can lead to server compromise through malicious file execution. All users running version 1.0 of this software are affected.
💻 Affected Systems
- itsourcecode Online Tour and Travel Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, data exfiltration, and further exploitation of the server.
If Mitigated
File uploads restricted to safe extensions with proper validation, limiting impact to denial of service or storage consumption.
🎯 Exploit Status
Exploit details are publicly available on GitHub. Attack requires access to the admin interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Remove or replace the vulnerable software.
🔧 Temporary Workarounds
Restrict file upload extensions
allModify travellers.php to only allow specific image file extensions (jpg, png, gif) and implement file type verification.
Disable admin interface access
allRestrict access to /admin/operations/travellers.php via web server configuration or firewall rules.
# Apache: <Location /admin/operations/travellers.php> Require all denied </Location>
# Nginx: location /admin/operations/travellers.php { deny all; }
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Monitor file upload directory for suspicious files and implement file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file (e.g., .php, .exe) via the photo parameter in /admin/operations/travellers.php. If successful, system is vulnerable.Check Version:
Check software documentation or admin panel for version information.Verify Fix Applied:
Attempt the same upload test; successful uploads should be rejected with proper validation errors.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /admin/operations/travellers.php
- Uploads of non-image file types
- Large or suspicious files in upload directories
Network Indicators:
- POST requests to /admin/operations/travellers.php with file uploads
- Unusual outbound connections from the web server
SIEM Query:
source="web_server" AND uri="/admin/operations/travellers.php" AND method="POST" AND file_upload="true"