Online Hotel Reservation System CVE-2025-11354

Exploitation requires authentication as a user with administrative privileges (PR:L per CVSS vector). The attacker must have access to the /admin/addslideexec.php endpoint, which is presumed restricted to logged-in admin users. No non-default configuration is mentioned in the CVE description; the vulnerability exists in the base product. The uploaded file must be stored in a web-accessible location with execution enabled for remote code execution to occur; if the application stores uploads outside the web root or disables script execution, the impact is reduced to potential information disclosure or denial of service through disk space exhaustion.

The CVSS:4.0 vector indicates authentication is required (PR:L), limiting the attack surface to logged-in administrators or users with admin privileges. The CVSS impact scores (VC:L, VI:L, VA:L) suggest low severity once exploitation occurs, though this may underestimate real-world risk if uploaded files can be executed server-side. The EPSS score of 0.05% (14th percentile) is notably low despite POC availability, suggesting exploitation requires either specific deployment configurations or that the vulnerability requires post-authentication access that most threat actors cannot reliably obtain. The presence of publicly available exploit code (GitHub reference) and the 'E:P' evidence code indicating proof-of-concept existence confirms the vulnerability is trivial to reproduce. Attack vector is network (AV:N) and attack complexity is low (AC:L), meaning no special network conditions are required. The mismatch between moderate CVSS (due to auth requirement) and very low EPSS suggests this is a privilege-escalation risk within compromised admin accounts rather than a primary attack vector for external threat actors.

An authenticated administrator account is compromised or an attacker gains legitimate admin access. The attacker navigates to the file upload feature in /admin/addslideexec.php and uploads a PHP webshell disguised as an image file by manipulating the image parameter (e.g., submitting shell.php.jpg or crafting a polyglot file). The server stores the file without validation. If the uploaded file lands in a web-accessible directory with execution enabled, the attacker can access the file via HTTP and execute arbitrary PHP code on the server.