Is there a public PoC exploit available for CVE-2025-11470?

Yes, a public proof-of-concept exploit is available for CVE-2025-11470. Prioritise patching immediately. EPSS: 0.1%.

Hotel and Lodge Management System CVE-2025-11470

Q: What is the CVSS score of CVE-2025-11470?

CVE-2025-11470 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-10-08 cna@vuldb.com

PHP Authentication Bypass File Upload Hotel And Lodge Management System Nikhil Bhalerao

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:03 vuln.today

DescriptionCVE.org

A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown function of the file /manage_website.php. The manipulation of the argument website_image/back_login_image leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Unrestricted file upload in SourceCodester Hotel and Lodge Management System version 1.0 allows high-privileged authenticated attackers to upload arbitrary files via the website_image or back_login_image parameters in /manage_website.php, potentially enabling remote code execution. Publicly available exploit code exists, though the low CVSS score of 2.0 reflects the requirement for high-level administrative privileges to trigger the vulnerability.

Technical ContextAI

The vulnerability exists in the /manage_website.php file, a PHP-based administrative interface for managing hotel website settings. The affected parameters (website_image and back_login_image) are intended to handle image uploads for website branding and login page customization. The file upload mechanism fails to properly validate or sanitize uploaded files, allowing attackers with high privileges to bypass file type restrictions and upload executable files (such as PHP shells). CWE-284 (Improper Access Control) indicates that authentication and authorization checks are insufficient - specifically, the access controls do not properly restrict who can upload files or what file types are permissible. The vulnerability is present in a widely distributed open-source PHP application, making the attack surface large among deployments that expose administrative interfaces.

RemediationAI

No vendor-released patch has been identified at time of analysis. Immediate mitigation requires: (1) restrict access to /manage_website.php and administrative functions to trusted IP ranges or VPN only, using web server firewall rules or application-level authentication layers; (2) implement strict file upload validation on the website_image and back_login_image parameters, including file type whitelist (JPEG, PNG only), MIME type verification, and file extension checking with server-side validation; (3) disable PHP execution in the upload directory by configuring the web server to block .php, .phtml, .php3, .php4, .php5, .phar execution (Apache: add 'php_flag engine off' or use .htaccess; nginx: use 'location ~ \.php$ {deny all;}'); (4) rename uploaded files to remove user-supplied extensions and store them outside the web root if possible; (5) audit administrator accounts for unauthorized access and enforce strong, unique passwords; (6) monitor /manage_website.php access logs for suspicious upload patterns. If a patch becomes available from SourceCodester or the maintainer, apply it immediately. Until remediation is complete, disable the website image upload feature entirely by modifying /manage_website.php to reject all file uploads.