School Management System CVE-2025-11659

No authentication is required - the /assets/uploadNotes.php endpoint is publicly accessible with no session or credential check (CVSS PR:N). No special network position, software configuration, or client-side interaction is needed. The only technical prerequisite is that the web server serves PHP files from the /assets/ upload directory, which is the default layout for this application. Exploitation is limited by: (1) the product being deployed - it is a niche PHP school management system with low global footprint; (2) the PHP execution not being explicitly confirmed as disabled in /assets/ by the description, though it is the default behavior for this application type.

The supplied CVSS 4.0 vector scores this at 5.5 (Medium) with VC:L/VI:L/VA:L, which substantially underrepresents the real-world impact of unauthenticated PHP webshell upload. Given that the upload endpoint is unauthenticated (PR:N confirmed by CVSS vector), the target is a PHP application serving the /assets/ directory, and a public PoC is already available, the realistic impact is full server compromise rather than low CIA triad impact. EPSS at 0.06% (19th percentile) reflects low observed exploitation activity at time of scoring, which is consistent with a niche, low-prevalence product rather than limited severity. No CISA KEV listing exists, but the combination of PR:N, a public exploit, and PHP execution context makes this a critical-priority finding for any deployed instance. The CVSS 4.0 impact metrics appear to have been set conservatively and do not reflect likely webshell upload outcomes - defenders should treat this as higher severity than the published score implies.

An unauthenticated attacker sends a crafted HTTP POST request to /assets/uploadNotes.php containing a PHP webshell as the File parameter. The server saves the file directly to the web-accessible /assets/ directory with no type checking. The attacker then issues a GET request to the uploaded file URL, achieving arbitrary OS command execution under the web server process account. A public PoC demonstrating this sequence is available at https://github.com/qqy-123/cve/issues/4.