Online Hotel Reservation System CVE-2025-11352

Exploitation requires a valid low-privilege admin account with access to the /admin/addexec.php endpoint. The 'image' parameter must accept the upload without server-side file type validation (the stated vulnerability). PHP execution must be enabled in the upload directory for the attack to progress to code execution; if uploads are stored outside the web root or in a directory with execution disabled, the impact is limited to storage of arbitrary files. The CVSS vector confirms no user interaction is required once the attacker is authenticated (UI:N), and exploitation can occur over the network (AV:N) with low complexity (AC:L). Authentication is the primary limiting factor - environments with strong admin account controls, regular credential rotation, and monitoring for failed login attempts substantially reduce exploitation likelihood.

This vulnerability presents a LOW but REAL risk despite its modest CVSS 2.1 score. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-based remote exploitation but requires low-privilege authentication - a crucial limiting factor that significantly reduces exposure compared to unauthenticated vectors. The EPSS score of 0.04% (14th percentile) reflects low likelihood of widespread automated exploitation, aligning with the authentication barrier. However, the presence of publicly available exploit code is a material risk factor for targeted attacks against instances with compromised or default low-privilege credentials. The impact is intentionally limited (VC:L/VI:L/VA:L) by the CVSSv4 scope constraint (SC:N), suggesting the vulnerability affects only the application itself, not underlying systems. Real-world risk depends critically on: (1) whether instances allow low-privilege admin account creation, (2) credential reuse/default credentials, and (3) PHP execution permissions on the upload directory. Organizations with strong access controls and non-executable upload directories face substantially lower risk than those with permissive admin account provisioning. This is NOT a critical vulnerability requiring emergency patching, but it IS a priority for inventory and targeted remediation in environments with known admin account compromise or weak credential hygiene.

An attacker with low-privilege admin credentials (obtained via credential stuffing, phishing, or public disclosure) logs into the Online Hotel Reservation System and navigates to the hotel/room addition function. They craft a POST request to /admin/addexec.php with a PHP webshell disguised as a JPEG image (e.g., shell.php.jpg or shell.php with image magic bytes prepended). The lack of file type validation allows the PHP file to be uploaded to a web-accessible directory. If the upload directory has PHP execution enabled, the attacker can then request the uploaded PHP file via HTTP to execute arbitrary code as the web server user, achieving remote code execution.