Online Hotel Reservation System CVE-2025-11351

Exploitation requires authenticated user access to the admin panel (PR:L in CVSS vector confirms authenticated account necessary). The vulnerable /admin/editpicexec.php endpoint must be accessible via the network (AV:N confirmed). The application must store uploaded files in a web-accessible directory with script execution enabled (typical PHP configuration). No special application configuration is required beyond default installation; the vulnerability exists in the base code. Exploitation is blocked if: the admin panel is restricted by network ACLs, the application directory has script execution disabled at the web server level, the upload directory requires authentication headers on direct access, or if file upload functionality has been patched in a newer version.

Risk assessment reveals a significant disconnect between CVSS and real-world exploitability. CVSS 2.1 reflects low impact scope (VC:L/VI:L/VA:L, all containing), but the vulnerability chain is straightforward: CVSS vector AV:N/AC:L/PR:L shows network-accessible remote attack with low complexity requiring authenticated user privileges. EPSS at 0.04th percentile (0.04% probability) suggests minimal empirical exploitation despite public POC, likely because the Online Hotel Reservation System 1.0 has extremely limited deployment compared to enterprise software. The publicly available exploit lowers the barrier to exploitation for attackers with legitimate admin credentials or who compromise weak admin accounts. Priority should be driven by whether the organization runs this specific product; if present, remediation is trivial (upgrade version or restrict upload endpoint), but risk is conditional on legitimate admin compromise or lateral movement post-breach. The low EPSS combined with POC availability suggests this is a non-critical issue in practice but exploitable once an admin account is compromised.

An authenticated administrator account holder (either legitimate insider or compromised via credential theft) navigates to /admin/editpicexec.php and uploads a PHP webshell disguised as an image file by manipulating the image parameter. The server stores the file in a web-accessible directory without validating file type or stripping dangerous extensions. The attacker then accesses the uploaded shell via direct HTTP request (e.g., /uploads/shell.php) and executes arbitrary code with application server privileges, potentially enabling data exfiltration, further system compromise, or lateral movement within the hotel's internal network.