PHP CVE-2025-11659

We need to produce a JSON object with the specified fields. Let's analyze the provided data:

CVE: CVE-2025-11659 Description: "A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided." CVSS Score: 5.5, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-284 (Improper Access Control) EPSS: 0.06% (percentile 19%) POC: Publicly available (exploit published) KEV? Not mentioned in input, so assume NO. Tags: PHP, Authentication Bypass, File Upload, School Management System CPE: cpe:2.3:a:oranbyte:school_management_system:1.0:*:*:*:*:*:*:* (vendor: oranbyte? Actually "ProjectsAndPrograms" might be the project name? The CPE says vendor "oranbyte", product "school_management_system", version 1.0. However, description says "ProjectsAndPrograms School Management System". Possibly the product is by ProjectsAndPrograms? The CPE suggests Oranbyte as vendor. I'll use the product name as "School Management System" and vendor as Oranbyte/ProjectsAndPrograms perhaps. For product_name field: 1-3 words ONLY. "School Management System" fits. Could also be "ProjectsAndPrograms SMS"? Best to stick with "School Management System". The description mentions "ProjectsAndPrograms School Management System", so the primary product is that system. I'll use "School Management System" as product_name, or maybe "ProjectsAndPrograms SMS"? Actually the field requires specific product; "School Management System" is generic but the name includes "ProjectsAndPrograms". I'll do "ProjectsAndPrograms School Management System" is 4 words, but I can shorten to "School Management System"? The instruction says 1-3 words. I'll use "School Management System" - it's clear and includes the product type. For prevalence: School management systems are somewhat niche but deployed in educational institutions. It might be low or medium. Given it's a specific web app, not ubiquitous. Probably "low" prevalence. Prevalence basis: "niche school management software, limited footprint". Not many large-scale deployments.

Now, we need to synthesize. There is no CVSS 3.1 vector provided; only CVSS 4.0 vector. We must provide our own assessed CVSS 3.1 base vector and CVSS 4.0 base vector. The description: unrestricted file upload via /assets/uploadNotes.php, manipulation of argument File, remote exploitation possible. The provided CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. This means no authentication (PR:N), no user interaction (UI:N), low impact to confidentiality, integrity, availability. But unrestricted file upload typically can lead to remote code execution if the uploaded file can be executed, but here the vector indicates only low impacts. Possibly the file upload is to a directory that does not execute scripts, or impact might be denial/storage exhaustion? The CWE is CWE-284 (Improper Access Control) not CWE-434 (Unrestricted Upload of File with Dangerous Type) — interesting. So maybe the file upload is allowed without proper access control, but could be abused to upload arbitrary files, but execution might not be possible. The exploit has been published, so we have POC. We'll note that.

Our assessed CVSS 3.1: Assuming the same as 4.0 mapping: AV:N, AC:L, PR:N, UI:N, S:U (no scope change from 4.0), C:L, I:L, A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Base score: 7.3 (High). But the given CVSS 4.0 had base score 5.5 (Medium). In 3.1, such a vector (C:L/I:L/A:L) scores 7.3. There's a discrepancy because 4.0 scores lower for same impacts. I'll assess as per my understanding of the vulnerability. Unrestricted file upload typically could lead to RCE if the file is executable, but the CVSS 4.0 only gives low impact for C/I/A, so maybe the upload destination does not allow execution, and the only impact is storage consumption or phishing? The exploit might allow uploading arbitrary files, but reading them might not provide sensitive data if they can't be accessed. It says "unrestricted upload" but not "arbitrary file upload leading to code execution". So low impacts plausible. I'll assess CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, but I need to justify. In CVSS 3.1, low confidentiality could be that uploaded files may be readable by attacker if they know the path (but file names might be predictable). Low integrity because attacker can upload files (overwrite maybe). Low availability because disk space can be filled. So that's plausible. So I'll set that.

Now, exploitation conditions: "Remote exploitation is possible" and "unknown functionality" but the file is /assets/uploadNotes.php. No authentication mentioned. The script uploads notes, maybe intended for authenticated users but lacks access control? CWE-284 suggests improper access control, so maybe the endpoint is unprotected, allowing anyone to upload. So condition: The file upload endpoint /assets/uploadNotes.php is accessible without authentication. Possibly it's a default exposed script. I'll state: "The /assets/uploadNotes.php endpoint in ProjectsAndPrograms School Management System does not enforce authentication or authorization checks, allowing any unauthenticated user to upload arbitrary files via the 'File' argument." That's specific. The description says "unknown functionality" but the endpoint is given. So I'll use that.

Attack chain: Remote attacker sends crafted HTTP POST request to /assets/uploadNotes.php with a malicious file → File is uploaded to server without validation → Attacker may access uploaded file for unauthorized actions or cause denial of service. No execution step, given low impact. So: "Access vulnerable endpoint" → "Craft malicious file payload" → "Upload file via HTTP POST" → "Gain unauthorized access to server resources or disrupt service". I'll make it a 4-step: "Access /assets/uploadNotes.php without authentication" → "Deliver crafted file via 'File' parameter" → "Exploit unrestricted upload to store file on server" → "Execute optional follow-on actions like unauthorized data access or disk exhaustion". That's realistic.

Remediation: The product uses rolling release, no version numbers provided. So we can't say upgrade to a specific version. Input data says patch available? The patch field in input not explicitly given, but the description says "This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided." So maybe there is an update but unspecified. From references, the GitHub issue (#4) might contain a fix? Possibly a commit hash? The commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59 is the "up to" point. There might be a later commit that fixes it, but not specified. I'll note that vendor has not published a specific patched version, but an update may be available via the rolling release. Suggest removing or restricting access to uploadNotes.php, implementing access controls, file type validation. So: "No specific patched version is available due to the product's rolling release model. Implement access controls on /assets/uploadNotes.php to require authentication, validate file types, and sanitize file names. Consider removing the endpoint if not needed. Monitor vendor updates." That's actionable.

Confidence notes: Confirmed by NVD, CVE from VulDB, POC publicly available. No KEV. EPSS very low (0.06%). No vendor advisory with specific fix. The exact fix commit unknown. So I'll note: "Exploit publicly available, confirmed by NVD and VulDB. No vendor patch version specified; product uses rolling release, making versioning ambiguous. CISA KEV not listed, and EPSS indicates low exploitation probability in the wild." That's specific.

Now, construct the summary: "Remote file upload in ProjectsAndPrograms School Management System through /assets/uploadNotes.php allows unauthenticated attackers to upload arbitrary files to the server, leading to potential data exposure or denial of service. Public exploit code exists, but no active exploitation reported; low EPSS score suggests limited real-world impact."

Technical context: "The vulnerability resides in the PHP-based School Management System, specifically in the uploadNotes.php script that handles file uploads via the 'File' parameter. CWE-284 (Improper Access Control) indicates a missing authorization check, allowing anyone to access the endpoint without authentication. The affected product is identified by CPE cpe:2.3:a:oranbyte:school_management_system:1.0, but the rolling release model means version numbers are not consistently applied." Educational.

Risk assessment: "CVSS 4.0 rates this as 5.5 Medium, with network attack vector, low impact to confidentiality, integrity, and availability. EPSS probability of exploitation is very low (0.06%), suggesting it is not targeted in the wild. No KEV listing indicates CISA does not consider it actively exploited. POC is public but exploitation requires the upload endpoint to be reachable; impact limited to file upload, not code execution, reducing real-world risk. This is a moderate-risk vulnerability that may be prioritized lower than critical RCE flaws." That compares and contrasts.

Exploit scenario: "An attacker sends an HTTP POST request to /assets/uploadNotes.php with a malicious file, such as a PHP webshell, if the server configuration permits execution of uploaded scripts; otherwise, the attacker may upload large files to exhaust disk space, causing denial of service." Realistic.

Exploitation conditions (specific): "The /assets/uploadNotes.php endpoint must be accessible via the web (typically at the application's base URL). No authentication is required. The attacker needs network access to the target server. The impact is limited by the server's configuration: if uploaded files cannot be executed (e.g., stored outside web root or restricted by .htaccess), confidentiality and integrity impacts are low, mainly denial of service by storage exhaustion."

Prevalence: "low" because it's a niche school management system, not widely deployed. Prevalence basis: "niche educational software, limited deployment footprint". Good.

Assessed CVSS 3.1 vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" and rationale: "No authentication or user interaction required; impact limited to low due to file upload without execution capability." For CVSS 4.0, I'll keep the same as provided, but with my own? The instruction says: "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So I need to map my assessed 3.1 to 4.0. My 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In CVSS 4.0 that maps to AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the provided vector, so I'll output that. Provided CVSS 4.0 has no scope change and low impacts, so consistent. So assessed_cvss40_vector = "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". Rationale for 4.0: "Same as provided vector: network accessible, no privileges, low impacts on vulnerable system, no subsequent system impact." I'll use that.

Now combine all. Ensure no arrays, everything string.

Product name: "School Management System" (capitalized). CPE says oranbyte: