SourceCodester Client Database Management System CVE-2025-14885

Successful exploitation requires valid authenticated user credentials (PR:L in CVSS vector). The application must permit file uploads through the /user_leads.php endpoint without proper type or content validation. Exploitation does NOT require administrative privileges, special system configuration, or user interaction. The attack is limited to authenticated users; unauthenticated remote attackers cannot directly trigger the vulnerability. File upload restrictions (if any exist) must be bypassable through common techniques such as extension manipulation or MIME type spoofing.

The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates network-accessible remote attack with low complexity but requiring low-privilege authentication. The low confidentiality, integrity, and availability impact scores (all L) suggest the vulnerability alone may not directly enable remote code execution, contradicting the RCE claims in some references. However, the E:P tag confirms published exploits exist. The EPSS score of 0.06% (19th percentile) is notably low despite public exploit availability, suggesting that real-world exploitation is hindered by the authentication requirement and limited impact scope - defenders should note this discrepancy between POC availability and actual exploitation probability. This is a medium-priority issue for systems with internet-facing instances and active user bases, but lower priority for internal-only deployments or those without authenticated external access.

An authenticated user with valid credentials (obtained through credential compromise or legitimate account access abuse) navigates to the /user_leads.php endpoint and uploads a PHP shell or other executable file disguised or permitted by insufficient validation. The server stores the file in an accessible location within the web root, allowing the attacker to execute the uploaded file remotely by requesting its URL, gaining server-level code execution capabilities.