Church Donation System
CVE-2025-7931
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP POST to /members/admin_pic.php
-
DeliveryUpload PHP webshell via unrestricted file upload
-
ExploitAccess uploaded file to execute PHP code
-
ExecutionGain remote code execution as web server
-
ImpactEscalate privileges if misconfigurations exist
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions required: the attack is remote, unauthenticated, and works against the default installation of Church Donation System 1.0. The server must allow PHP execution in the upload directory and have write permissions for the web server user. No authentication, user interaction, or special configuration is needed. |
| Impact | CVSS 4.0 base score 5.5 (medium) with AV:N/AC:L/AT:N/PR:N/UI:N indicates low complexity, unauthenticated remote exploitation, but low impact on confidentiality, integrity, and availability (VC:L/VI:L/VA:L). Despite the medium CVSS score, the vulnerability enables remote code execution, raising technical impact. EPSS at 0.09% (25th percentile) suggests very low probability of exploitation in the wild. A public proof-of-concept exists but no CISA KEV entry, confirming limited active exploitation. SSVC would likely rate this as 'Exploitation: PoC' but not 'Active', and 'Automatable: Yes' due to simple upload, so it is a moderate priority with need for quick patching if the product is deployed. |
| Exploit ScenarioDerived | An unauthenticated attacker sends an HTTP POST request to /members/admin_pic.php with a PHP webshell as the 'image' parameter. The script saves the file with its original extension to the server. The attacker then navigates to the uploaded file and executes arbitrary PHP commands, gaining initial foothold on the web server. A public exploit script is available, simplifying the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Remote unrestricted file upload in code-projects Church Donation System 1.0 allows unauthenticated attackers to upload arbitrary PHP shells via the /members/admin_pic.php endpoint, achieving remote code execution as the web server. A public exploit is available, but EPSS (0.09%) indicates low active exploitation probability.
RemediationAI
No vendor-released patch or updated version has been identified. Recommended actions: remove or disable the /members/admin_pic.php endpoint if not required, or implement strict file validation (whitelist extensions, check MIME, rename files, disable PHP execution in upload directories via .htaccess). As a workaround, restrict network access to this endpoint using a web application firewall (WAF) or server-level access rules. Monitor the code-projects.org website for an official fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-284 (Improper Access Control) describes the root cause: the admin_pic.php script fails to validate or restrict uploaded files based on type, content, or extension. The CPE (cpe:2.3:a:carmelo:church_donation_system:1.0:*:*:*:*:*:*:*) confirms only version 1.0 of this open-source PHP application is affected. The vulnerability class is unrestricted file upload (CWE-434), which allows code execution if the uploaded file is accessible and PHP execution is enabled.
Know when Church Donation System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote file upload; low impact per CVSS constraints.
Primary rating from NVD.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability was found in code-projects Church Donation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /members/admin_pic.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Affected Products (CPE)CVE.org
More in Church Donation System
View allSQL injection in Church Donation System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the database by injecting SQL commands
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the
SQL injection in code-projects Church Donation System 1.0 enables unauthenticated remote attackers to read or modify dat
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the
SQL injection in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to manipulate the new_
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the Amount parameter in /members/givin
SQL injection in Church Donation System 1.0 allows remote attackers to execute arbitrary SQL commands via the trcode par
SQL injection in Church Donation System 1.0 enables remote attackers to execute arbitrary SQL commands via the trcode pa
We are tasked with synthesizing a CVE analysis for CVE-2025-7830. We must output a JSON object with specific fields. Le
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the
Exploit-DB