EUVD-2025-21275Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects the function save_movie of the file /admin/admin_class.php. The manipulation of the argument cover leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
AnalysisAI
CVE-2025-7547 is a critical unrestricted file upload vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the save_movie function in /admin/admin_class.php. An unauthenticated remote attacker can manipulate the 'cover' parameter to upload arbitrary files, potentially leading to remote code execution, data compromise, and service disruption. The exploit has been publicly disclosed and may be actively exploited in the wild.
Technical ContextAI
The vulnerability exists in a PHP-based web application (Campcodes Online Movie Theater Seat Reservation System 1.0) where the admin_class.php file handles movie data persistence. The save_movie function fails to implement proper file upload validation on the 'cover' parameter, allowing arbitrary file types to be uploaded without extension, MIME type, or content validation. This is classified under CWE-284 (Improper Access Control), but more accurately represents CWE-434 (Unrestricted Upload of File with Dangerous Type) patterns. The application appears to be built on PHP with direct file system write capabilities, making arbitrary PHP file uploads particularly dangerous. CPE identifier: cpe:2a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:*
RemediationAI
{'type': 'Immediate Mitigation', 'action': 'Restrict access to /admin/admin_class.php to authenticated users only using web server configuration (Apache/Nginx/.htaccess rules) or application-level authentication checks'} {'type': 'Input Validation', 'action': 'Implement strict file upload validation in save_movie function: (1) Whitelist allowed file extensions (.jpg, .jpeg, .png, .gif only), (2) Validate MIME types server-side using php_fileinfo, (3) Check file content headers (magic bytes), (4) Store uploads outside web root or in non-executable directory, (5) Rename uploaded files with random identifiers'} {'type': 'Patching', 'action': 'Contact Campcodes for security update. If unavailable, consider alternative solutions or fork/patch internally. Check vendor website/GitHub for CVE-2025-7547 patch availability'} {'type': 'Deployment Hardening', 'action': 'Disable PHP execution in upload directories via web server configuration (.htaccess: AddType text/plain .php, or nginx location directive)'} {'type': 'Monitoring', 'action': 'Monitor /admin/admin_class.php for unusual POST requests, implement file integrity monitoring on upload directories, log all file upload attempts with source IP and filename'}
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today