Online Hotel Reservation System CVE-2025-11353

Authentication as an admin user is required (PR:L in CVSS indicates low-privileged or authenticated access). The exploitation depends on the /admin/ path being accessible and the addgalleryexec.php endpoint accepting POST requests with the image parameter. The vulnerability is triggered only when an attacker manipulates the image parameter during file upload - normal image uploads may not exhibit the flaw if they use legitimate image data. Additionally, exploitation of uploaded files for code execution is contingent on the server executing PHP scripts in the upload directory, which is a common but not universal configuration. If uploads are stored outside the web root or configured as non-executable, the upload itself succeeds but post-exploitation impact is significantly reduced.

CVSS 2.1 with authentication requirement (PR:L) indicates low severity, but signals are mixed. The CVSS vector shows limited technical impact (VC:L/VI:L/VA:L) with no scope change, suggesting contained compromise of the gallery function rather than system-wide compromise. EPSS at 0.04% (14th percentile) reflects very low real-world exploitation likelihood, contradicting the 'publicly available' POC status. This discrepancy suggests the exploit requires effort to weaponize, knowledge of valid admin credentials, or targets a niche application with few deployments. The authentication requirement (PR:L) significantly limits attack surface compared to unauthenticated RCE vulnerabilities. However, in shared hosting or poorly managed admin accounts, the risk is elevated. This is a real vulnerability but not an immediate priority for most organizations unless Online Hotel Reservation System is in production.

An attacker with valid admin credentials (obtained via credential stuffing, weak password, or social engineering) accesses the admin panel and navigates to the gallery upload function. By intercepting the HTTP request to /admin/addgalleryexec.php and modifying the image parameter to include a PHP webshell (e.g., shell.php.jpg or via polyglot file techniques), the attacker bypasses client-side validation and uploads the malicious file. If the server is misconfigured to execute PHP in the upload directory, the attacker accesses the shell via HTTP and gains code execution within the application's privilege context.