Campcodes Online Hotel Reservation System CVE-2025-8379

Exploitation requires valid high-privileged administrator account credentials to authenticate to the Campcodes admin interface and access /admin/edit_room.php. The vulnerability does NOT require any special configuration or non-default setup - all installations of version 1.0 are vulnerable if an admin account is compromised. The limiting factor is authentication: unauthenticated remote attackers cannot exploit this. The attack is contingent on prior account compromise or insider threat. No user interaction (UI:N) is required once authenticated.

This vulnerability presents a CRITICAL MISMATCH between CVSS scoring and real-world risk. The CVSS v4.0 score of 2.0 and EPSS of 0.11% (29th percentile) both indicate LOW exploitation probability and impact, contradicting the 'critical' severity label in the description. The key limiting factor is PR:H (high privilege required), meaning only administrators can exploit it - this dramatically reduces real-world risk compared to unauthenticated remote code execution. However, the publicly available POC and network-accessible endpoint (AV:N) mean that once an admin account is compromised through other means (credential theft, phishing, weak passwords), this becomes a lateral movement vector for privilege escalation or persistence. SSVC analysis suggests this is NOT an emergency patch: exploitation requires privileged insider threat or prior account compromise, automatable but not widespread. The contradiction between 'critical' label and CVSS 2.0 suggests either vendor miscalibration or that the description undersells non-obvious impacts (e.g., if uploaded files can be chained with other vulnerabilities). VERIFY: Does admin compromise in this application grant sufficient access to execute uploaded code, or are uploads sandboxed/restricted by the web server?

An attacker with compromised administrative credentials (obtained via credential stuffing, phishing, or weak password) authenticates to the Campcodes admin panel, navigates to the room editing interface, and uploads a PHP web shell or malicious image file with embedded PHP code via the photo parameter in /admin/edit_room.php. The unvalidated upload handler accepts the file and stores it in a web-accessible directory. The attacker then directly accesses the uploaded shell via HTTP, achieving remote code execution on the server with web server privileges. Publicly available POC code demonstrates this attack path.