Computer Laboratory System CVE-2025-14641

Exploitation requires a valid high-privilege (administrator) account on the Computer Laboratory System instance. The attacker must be authenticated as an admin user to access the admin/admin_pic.php endpoint and submit the crafted file upload request. The vulnerability does NOT affect unauthenticated remote users or low-privilege accounts. Additionally, successful exploitation depends on the web server not having post-upload protections (e.g., script execution disabled in the upload directory); if the server is configured to block PHP execution in the upload folder, the attacker's ability to gain remote code execution is mitigated even after a successful upload. The attack is constrained to scenarios where admin credentials are available or compromised, making this a post-authentication privilege escalation or a secondary attack following credential compromise rather than a standalone remote code execution vector.

This vulnerability presents a paradoxical risk profile: while CVSS 2.0 is extremely low due to the PR:H (high privilege) requirement, the actual risk depends on the attack scenario. The EPSS score of 0.07% (percentile 21%) reflects low real-world exploitation likelihood, consistent with the high authentication barrier. However, the presence of a publicly available proof-of-concept and the simplicity of the vulnerability create localized risk for environments where admin accounts are compromised or shared. The attack vector is network-accessible (AV:N) with low complexity (AC:L), meaning any user with admin credentials can exploit it trivially. In a shared hosting or educational environment where administrative accounts may be less stringently protected, this becomes a practical privilege escalation vector-an admin with compromised credentials could upload a PHP webshell to gain full code execution. The limited scope and confidentiality/integrity/availability impact in the CVSS vector (VC:L/VI:L/VA:L) suggest the vulnerability alone may not cause system-wide compromise, but file upload vulnerabilities frequently enable secondary exploitation (e.g., webshell uploads leading to RCE). This is not a critical network-wide threat but a real concern in targeted attacks against administrators or shared environments.

An attacker with compromised administrator credentials (or through social engineering) logs into the Computer Laboratory System web interface, navigates to the profile picture upload feature at admin/admin_pic.php, and uploads a PHP webshell or executable file by exploiting the lack of file type validation on the 'image' parameter. The uploaded malicious file is stored on the server and is subsequently accessible via HTTP, allowing the attacker to execute arbitrary code on the server with the privileges of the web application. Publicly available POC code demonstrates this attack in a few simple steps.