What is the CVSS score of CVE-2025-5840?

CVE-2025-5840 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-5840?

A high-severity file upload vulnerability in SourceCodester Client Database Management System 1.0 allows unauthenticated attackers to upload arbitrary files remotely, potentially leading to system…

Is there a public PoC exploit available for CVE-2025-5840?

Yes, a public proof-of-concept exploit is available for CVE-2025-5840. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-5840?

Within 24 hours: Immediately disable or restrict access to the /user_update_customer_order.php endpoint using firewall rules or network segmentation; audit recent file uploads for suspicious activity. Within 7 days: Identify all systems running SourceCodester Client Database Management System 1.0 and document inventory; implement strict file type validation and file size limits at the application layer; deploy WAF rules to block suspicious upload requests. Within 30 days: Migrate to an alternative database management solution or contact vendor for security advisory; conduct forensic analysis of the application server for signs of compromise or unauthorized file uploads.

PHP CVE-2025-5840

EUVD-2025-17378 HIGH

Improper Access Control (CWE-284)

2025-06-07 cna@vuldb.com

PHP File Upload Client Database Management System Lerouxyxchire

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:13 euvd

EUVD-2025-17378

Analysis Generated

Mar 14, 2026 - 19:13 vuln.today

PoC Detected

Jun 10, 2025 - 15:45 vuln.today

Public exploit code

CVE Published

Jun 07, 2025 - 18:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_update_customer_order.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possible to initiate the attack remotely.

AnalysisAI

Critical unrestricted file upload vulnerability in SourceCodester Client Database Management System 1.0, affecting the /user_update_customer_order.php endpoint. An unauthenticated remote attacker can upload arbitrary files by manipulating the 'uploaded_file' parameter, potentially leading to remote code execution, data integrity compromise, and service disruption. The vulnerability has a CVSS 7.3 score and poses moderate-to-high real-world risk given the unauthenticated attack vector and low complexity.

Technical ContextAI

The vulnerability stems from improper input validation in file upload handling, classified under CWE-284 (Improper Access Control – Permissions, Privileges, and Other Access Controls). The affected file /user_update_customer_order.php processes the 'uploaded_file' parameter without adequate verification of file type, size, destination, or permissions. This is likely a PHP-based web application vulnerable to arbitrary file upload attacks. The root cause is the absence of server-side validation mechanisms such as file extension whitelisting, MIME type verification, stored file isolation from web root, and access control checks. SourceCodester products are known for open-source database management systems often deployed on shared hosting with PHP/MySQL stacks, making them targets for opportunistic attackers.

RemediationAI

action: Immediate - Apply Vendor Patch; details: Check SourceCodester official repositories and vendor advisories for patched versions. Upgrade to the latest available version beyond 1.0 that includes file upload validation fixes.
action: Workaround - Implement Web Application Firewall (WAF) Rules; details: Deploy WAF rules to block suspicious file uploads to /user_update_customer_order.php. Restrict uploads by file extension (whitelist only safe types: .pdf, .jpg, .png, .docx) and MIME type validation.
action: Mitigation - Server-Level Access Control; details: Configure web server to prevent execution of scripts in the upload directory (e.g., disable PHP execution in upload folders via .htaccess or nginx config). Move uploaded files outside the web root.
action: Mitigation - File Validation; details: Implement server-side validation: verify file extension against a whitelist, validate MIME types, enforce file size limits, rename uploaded files with random names, and store outside the web-accessible directory.
action: Monitoring - Enhanced Logging; details: Enable detailed logging of all upload attempts to /user_update_customer_order.php. Monitor for suspicious file types (e.g., .php, .exe, .sh) being uploaded or accessed.
action: Defense-in-Depth - Authentication & Authorization; details: Although the vulnerability is pre-auth, adding authentication and proper authorization checks to the upload endpoint provides additional defense layers.