Is there a public PoC exploit available for CVE-2025-11417?

Yes, a public proof-of-concept exploit is available for CVE-2025-11417. Prioritise patching immediately. EPSS: 0.0%.

Campcodes Advanced Online Voting System CVE-2025-11417

Q: What is the CVSS score of CVE-2025-11417?

CVE-2025-11417 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Access Control (CWE-284)

2025-10-08 cna@vuldb.com

PHP Authentication Bypass File Upload Advanced Online Voting System Campcodes

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:32 vuln.today

DescriptionCVE.org

A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This vulnerability affects unknown code of the file /admin/voters_add.php. Executing manipulation of the argument photo can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.

AnalysisAI

Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to upload arbitrary files via manipulation of the photo parameter in /admin/voters_add.php. The vulnerability requires valid login credentials (PR:L) but affects confidentiality, integrity, and availability with low severity. Publicly available exploit code exists; however, EPSS score of 0.04% indicates minimal real-world exploitation probability despite public POC availability.

Technical ContextAI

The vulnerability exists in the PHP-based voters_add.php administrative endpoint, which processes file uploads through an insufficiently validated photo parameter. The underlying issue is classified as CWE-284 (Improper Access Control), indicating inadequate input validation and file type restrictions on uploaded content. Attackers with authenticated admin access can bypass file upload controls by directly manipulating the photo parameter to upload files with arbitrary MIME types or extensions, potentially leading to code execution if uploaded files are executable (e.g., .php) and accessible via the web root.

RemediationAI

Immediate mitigation requires upgrading Campcodes Advanced Online Voting System beyond version 1.0; however, no patched version has been confirmed in public advisories. If upgrades are unavailable, implement compensating controls: (1) Restrict /admin/voters_add.php access to trusted IP ranges via web server configuration (trade-off: reduces administrative flexibility if remote admin access is required), (2) Enforce strict file type validation on the photo parameter by checking MIME types and file magic bytes server-side, rejecting any uploads not matching expected image formats (.jpg, .png), (3) Store uploaded files outside the web root with non-executable permissions (chmod 644) and serve via download handler rather than direct HTTP access, and (4) Disable PHP execution in upload directories via .htaccess (php_flag engine off) or nginx configuration. Contact Campcodes directly at www.campcodes.com to request patched releases or security guidance.