Is there a public PoC exploit available for CVE-2025-8255?

Yes, a public proof-of-concept exploit is available for CVE-2025-8255. Prioritise patching immediately. EPSS: 0.1%.

Exam Form Submission CVE-2025-8255

Q: What is the CVSS score of CVE-2025-8255?

CVE-2025-8255 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Access Control (CWE-284)

2025-07-28 cna@vuldb.com

PHP Authentication Bypass File Upload Exam Form Submission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network upload to a PHP web root yields full RCE; scope changes to the hosting server, warranting S:C and H/H/H impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:49 vuln.today

CVE Published

Jul 28, 2025 - 04:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /register.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the image parameter of the /register.php registration endpoint. If uploaded files are stored in a web-accessible, script-executable directory (the typical deployment pattern for this PHP application), this flaw enables full remote code execution on the underlying server. A publicly available proof-of-concept exploit exists per a GitHub issue reference; EPSS is low at 0.12% (30th percentile), reflecting the product's limited deployment footprint rather than low exploitability. No active exploitation is confirmed in CISA KEV.

Technical ContextAI

The affected application is a PHP-based web form system, identified by CPE cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:*, built and distributed by code-projects.org as an educational project. The vulnerable endpoint /register.php processes a user-supplied file upload via the image parameter without enforcing any restriction on file type, MIME type, or extension. The assigned CWE-284 (Improper Access Control) captures the root cause: the application fails to enforce access control over what content may be uploaded to the server. In PHP applications, when uploaded files are stored within the web root in an executable context, an attacker can upload a .php webshell and trigger execution via a direct HTTP request - bypassing any application-layer logic entirely. The tags include 'Authentication Bypass' and 'File Upload', consistent with a registration-stage flaw that precedes any authentication gate.

RemediationAI

No vendor-released patch has been identified at the time of analysis for code-projects Exam Form Submission 1.0. Administrators should apply the following specific compensating controls immediately: first, modify /register.php to validate uploaded file types against a strict allowlist of non-executable extensions (e.g., .jpg, .png, .gif) using both MIME type inspection and extension checks - note that extension-only checks can be bypassed with double extensions. Second, configure the upload destination directory to disallow PHP execution at the web server level (e.g., adding php_flag engine off in an .htaccess file for Apache, or a location block deny in nginx) - this prevents webshell execution even if a malicious file is uploaded. Third, store uploaded files outside the web root entirely and serve them through a PHP proxy that enforces content-type headers; this eliminates direct URL-based execution. Restrict public access to /register.php via network controls or IP allowlisting if open registration is not operationally required. The exploit POC is referenced at https://github.com/Dingzenggonpo/cve/issues/4 and further details are at https://vuldb.com/?ctiid.317843.