Campcodes Advanced Online Voting System CVE-2025-11417

CRITICAL: This vulnerability requires valid administrative credentials (PR:L in CVSS vector) - unauthenticated remote exploitation is not possible. The photo parameter in /admin/voters_add.php must accept file uploads without proper type validation. Exploitation is further limited by file execution context: uploaded files must be stored in a web-accessible directory AND that directory must permit script execution (PHP in this case). If the application stores uploads outside the web root, disables script execution in upload folders, or serves uploads via download handlers only, exploitation impact is significantly reduced to disclosure of arbitrary file presence rather than code execution. The vulnerability does NOT require special application configuration beyond the default - it represents a flaw in the baseline 1.0 release.

Risk profile presents contradictory signals requiring careful contextualization. The CVSS 4.0 vector (AV:N/AC:L/PR:L) indicates remote exploitation requiring valid credentials with low complexity, resulting in limited scope (SC:N) and low confidentiality/integrity/availability impact (VC:L/VI:L/VA:L). The EPSS score of 0.04% (14th percentile) suggests exploitation is extremely unlikely in real-world conditions despite public POC availability - this indicates the vulnerability requires uncommon conditions (specific administrative access, likely low-value targets) rather than widespread automated exploitation. The E:P tag acknowledges POC exists but does not elevate real-world risk. CVSS does not account for authentication burden: this is NOT an unauthenticated RCE. Real risk depends on: (1) whether administrators regularly upload user-supplied photos, (2) whether uploaded files execute in web-accessible directories, and (3) administrative account security posture. For most organizations, the primary risk is lateral movement by compromised admin accounts rather than external attack.

An administrator's account is compromised via phishing or credential reuse. The attacker logs into /admin/ and navigates to voters_add.php, uploading a PHP web shell by setting the photo parameter to a malicious .php file. If the upload directory executes scripts and is web-accessible, the attacker gains remote code execution as the web server user, allowing data exfiltration or further compromise.