School Management System
CVE-2025-11660
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unrestricted file upload in PHP context likely leads to remote code execution with high impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this issue is some unknown functionality of the file /assets/uploadSllyabus.php. Such manipulation of the argument File leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.
AnalysisAI
Unrestricted file upload in Oranbyte School Management System allows remote attackers to upload arbitrary files, including PHP shells, to the server via the /assets/uploadSllyabus.php endpoint. The vulnerability requires no authentication and has a publicly available exploit, but the low EPSS score (0.06%) suggests limited active exploitation. Attackers can achieve code execution if the uploaded file is accessible and executable.
Technical ContextAI
The vulnerability resides in a PHP-based school management system (Oranbyte, version 1.0 per CPE) using a rolling release model. The file /assets/uploadSllyabus.php processes file uploads without proper validation of the File argument, leading to unrestricted upload (CWE-284: Improper Access Control). This class of vulnerability in PHP applications typically allows remote code execution if uploaded files can be executed in the web context.
RemediationAI
No official patched version is available due to the rolling release model. As a workaround, restrict file uploads to allowed extensions (e.g., images only), move the upload directory outside the web root, disable PHP execution in the upload directory via .htaccess (e.g., 'php_flag engine off'), or implement authentication for the upload endpoint. These mitigations may break legitimate upload functionality. Monitor the project repository for a fix addressing the commit hash.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today