Advanced Library Management System CVE-2025-11426

Authentication is required - the CVSS vector PR:L confirms that exploitation requires valid user credentials with at least low-level privileges in the application. The attack targets the /edit_book.php endpoint specifically when processing the image parameter during book record editing workflows. Exploitation is not possible against unauthenticated sessions or user accounts without edit permissions. The vulnerability is limited to version 1.0; later versions status is unknown. No special server configuration or non-default settings are required beyond standard PHP/web server deployment.

This vulnerability presents low practical risk despite network accessibility. The CVSS 4.0 vector (AV:N/AC:L/PR:L) requires valid authentication credentials (PR:L), significantly limiting attack surface compared to unauthenticated exploits. The EPSS score of 0.05% (15th percentile) contradicts the 'publicly available' POC status, indicating that while technical exploitation is possible, real-world adoption by threat actors remains minimal. The impact is capped at low-level violations in confidentiality, integrity, and availability (VC:L/VI:L/VA:L), preventing system takeover or critical data exfiltration. The presence of public exploit code reduces attack barriers but has not translated to widespread exploitation, suggesting either narrow affected deployment base, limited business value of the target application, or effective compensating controls in production environments. Defenders should prioritize patch deployment over immediate emergency response given the EPSS signal.

An authenticated user (legitimate application user or compromised low-privilege account) navigates to edit an existing book record and modifies the image upload field to submit a PHP webshell or other malicious executable instead of an image file. The application accepts the upload due to insufficient file type validation. The attacker then accesses the uploaded file to execute arbitrary code or gain further system access. Public exploit code simplifies this process by automating payload delivery.