Which versions of PHP are affected by CVE-2025-7538?

An unauthenticated attacker can upload arbitrary files to systems running Campcodes Sales and Inventory System 1.0, potentially compromising data integrity, system availability, and enabling further…

Is there a public PoC exploit available for CVE-2025-7538?

Yes, a public proof-of-concept exploit is available for CVE-2025-7538. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7538?

Within 24 hours: Disable or restrict access to /pages/product_update.php; audit recent file uploads for suspicious activity; inventory all affected systems. Within 7 days: Implement WAF rules to block POST requests to the vulnerable endpoint or validate file uploads; consider network segmentation to limit lateral movement. Within 30 days: Evaluate migration to alternative vendor solutions or evaluate patched versions when available; conduct forensic analysis of logs for breach indicators.

PHP CVE-2025-7538

Q: What is the CVSS score of CVE-2025-7538?

CVE-2025-7538 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21266 MEDIUM

Improper Access Control (CWE-284)

2025-07-13 cna@vuldb.com

PHP Authentication Bypass File Upload Sales And Inventory System Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21266

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 16, 2025 - 14:54 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 19:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability classified as critical was found in Campcodes Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/product_update.php. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

CVE-2025-7538 is a critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System version 1.0, specifically in the /pages/product_update.php file's image parameter handling. An unauthenticated remote attacker can upload arbitrary files without restriction, potentially leading to remote code execution, data compromise, and system availability impact. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant concern.

Technical ContextAI

The vulnerability exists in a PHP-based web application (Campcodes Sales and Inventory System) that implements product management functionality. The /pages/product_update.php endpoint accepts file uploads via the 'image' parameter without proper validation, filtering, or access controls. This falls under CWE-284 (Improper Access Control) combined with CWE-434 (Unrestricted Upload of File with Dangerous Type). The root cause is insufficient input validation and file type verification on the server-side, allowing attackers to bypass intended security controls. PHP applications commonly suffer from this class of vulnerability when uploaded files are not sanitized for MIME type, extension, or content before being stored in web-accessible directories.

RemediationAI

Immediate actions: (1) Disable or restrict access to /pages/product_update.php pending patch availability; (2) Implement strict file upload validation on the server-side: verify MIME type (Content-Type header), validate file extensions against a whitelist (e.g., .jpg, .png only), and check file content magic bytes; (3) Store uploaded files outside the web root directory to prevent direct execution; (4) Implement proper access controls requiring authentication and authorization checks before allowing uploads. Patch remediation: Contact Campcodes directly for security patches addressing CVE-2025-7538, as no official patch version is referenced in current intelligence. Temporary mitigation: Apply Web Application Firewall (WAF) rules to block requests to /pages/product_update.php or enforce strict Content-Type validation on the image parameter. Implement file upload rate limiting and monitor for suspicious upload patterns.