Is there a public PoC exploit available for CVE-2025-11351?

Yes, a public proof-of-concept exploit is available for CVE-2025-11351. Prioritise patching immediately. EPSS: 0.0%.

Online Hotel Reservation System CVE-2025-11351

Q: What is the CVSS score of CVE-2025-11351?

CVE-2025-11351 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Access Control (CWE-284)

2025-10-07 cna@vuldb.com

PHP Authentication Bypass File Upload Online Hotel Reservation System Fabian

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:01 vuln.today

DescriptionCVE.org

A weakness has been identified in code-projects Online Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/editpicexec.php. This manipulation of the argument image causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

AnalysisAI

Unrestricted file upload in code-projects Online Hotel Reservation System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /admin/editpicexec.php, potentially leading to remote code execution. The vulnerability affects a low-impact scope but is publicly exploitable by authenticated users; EPSS scores this at 0.04% exploitation probability despite public POC availability, indicating limited real-world adoption of the vulnerable software.

Technical ContextAI

The vulnerability exists in the PHP-based file upload handler at /admin/editpicexec.php, which fails to properly validate or restrict the image parameter, resulting in arbitrary file upload capability classified as CWE-284 (Improper Access Control). The affected application is a web-based hotel reservation system written in PHP, commonly deployed on shared hosting or educational environments. The absence of proper file type validation, file size limits, or storage isolation allows an authenticated admin user to upload executable files (e.g., PHP shells) to the web-accessible directory, enabling code execution with application privileges.

RemediationAI

Upgrade to a patched version if available from code-projects.org; check https://code-projects.org/ for updated releases beyond 1.0. If no patch is available, implement immediate compensating controls: restrict /admin/editpicexec.php to only authenticated administrators via IP allowlist or VPN; disable or remove the file upload feature entirely if not critical to operations (modify or comment out the upload handler in editpicexec.php); implement strict MIME-type validation and file extension whitelisting (e.g., only .jpg, .png, .gif) on both client and server; store uploaded files outside the web root in a non-executable directory with disabled script execution in the web server configuration (e.g., Apache directive 'php_flag engine off' in the upload directory); rename uploaded files to remove extensions and serve them via download handler rather than direct execution. Most effective: restrict admin panel access to a dedicated internal network segment or implement multi-factor authentication for admin accounts to prevent unauthorized login.