Client Database Management System CVE-2025-5840

The CVSS 7.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates a HIGH-RISK vulnerability: network-accessible without authentication or user interaction, low attack complexity, and impacts confidentiality, integrity, and availability. The 'PR:N' (no privileges required) and 'UI:N' (no user interaction) factors are particularly concerning. While the impact ratings are listed as 'Low' individually, the combination creates a moderate real-world impact. Without EPSS score data provided, exploitation probability appears high given the straightforward nature of file upload bypass techniques. The absence of access control verification (CWE-284) directly enables pre-authentication exploitation. This is not a high-CVSS-low-risk scenario; rather, it represents a genuine critical threat to deployed instances, especially in environments with weak additional controls.

An attacker discovers a SourceCodester Client Database Management System 1.0 instance deployed on a public-facing web server. The attacker crafts an HTTP POST request to /user_update_customer_order.php with a malicious PHP shell as the 'uploaded_file' parameter, bypassing client-side and server-side validation. The server accepts and stores the file in an accessible directory (e.g., /uploads/ or similar). The attacker then navigates to the uploaded file's URL and triggers execution of the PHP shell, achieving remote code execution. From here, the attacker can read sensitive database files, modify customer orders, exfiltrate data, or pivot to internal systems. The attack requires no authentication, no user interaction, and can be automated, making it attractive for mass scanning and exploitation. Given AC:L (low complexity), this could be exploited by script kiddies using readily available tools.