Student File Management System CVE-2025-15050

Authentication is required - the CVSS v4.0 vector specifies PR:L, meaning the attacker must possess valid login credentials to the Student File Management System. The exploit targets the /save_file.php endpoint specifically and manipulates the File parameter; successful exploitation depends on the server failing to properly validate or sanitize this parameter before processing file uploads. The vulnerability is limited to authenticated users with file upload access, and exploitation requires the web server to have write permissions to the target directory. No evidence suggests the vulnerability affects default configurations of other products or non-upload scenarios.

Risk assessment reveals conflicting signals that warrant caution: the CVSS v4.0 vector indicates low impact (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N - no scope change, no system integrity or availability impact), suggesting the vulnerability's real-world severity may be constrained; however, the CVSS v4.0 score of 2.1 contradicts typical file upload vulnerabilities which often carry higher impact ratings. The EPSS score of 0.09% (25th percentile) indicates very low probability of exploitation in the wild despite public exploit availability, suggesting the vulnerability may be environment-specific or require niche deployment conditions. The CVSS vector specifies PR:L (authenticated access required), significantly limiting attack surface compared to unauthenticated file upload vulnerabilities. Attack vector is network-accessible and attack complexity is low, but the low impact metrics combined with extremely low EPSS suggest this is a low-priority issue for most organizations unless the system is mission-critical or exposed to untrustworthy authenticated users. The authentication requirement and low impact scoring indicate this is unlikely to be weaponized at scale.

An authenticated user with valid login credentials crafts a malicious HTTP request to /save_file.php with a manipulated File parameter containing path traversal sequences (e.g., ../../../shell.php) or executable file extensions, bypassing client-side or weak server-side file type validation. The server processes the request and writes the file to an unintended location or with an unintended file type, potentially allowing the attacker to upload a PHP web shell or other executable payload that executes with the web server's privileges.