Is there a public PoC exploit available for CVE-2025-8379?

Yes, a public proof-of-concept exploit is available for CVE-2025-8379. Prioritise patching immediately. EPSS: 0.1%.

Campcodes Online Hotel Reservation System CVE-2025-8379

Q: What is the CVSS score of CVE-2025-8379?

CVE-2025-8379 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Access Control (CWE-284)

2025-07-31 cna@vuldb.com

PHP Authentication Bypass File Upload Online Hotel Reservation System Campcodes

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:19 vuln.today

DescriptionCVE.org

A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/edit_room.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Unrestricted file upload in Campcodes Online Hotel Reservation System 1.0 allows high-privileged authenticated administrators to upload arbitrary files via the photo parameter in /admin/edit_room.php, potentially leading to remote code execution. The vulnerability requires administrative credentials to exploit and has publicly available proof-of-concept code, but carries low real-world risk due to the high privilege requirement (PR:H) and limited confidentiality/integrity impact in the CVSS v4.0 vector.

Technical ContextAI

The vulnerability exists in the administrative file upload handler at /admin/edit_room.php, where the photo parameter fails to properly validate or restrict uploaded file types. This is a classic unrestricted file upload flaw (CWE-284: Improper Access Control) that occurs in the context of a PHP-based hotel reservation system. The file upload mechanism does not implement proper validation such as file type checking, MIME type verification, or extension whitelisting. An attacker with administrative access could potentially upload PHP files or other executable content to achieve remote code execution, though the CVSS v4.0 vector's VC:L/VI:L/VA:L ratings suggest the vendor's assessment limits the scope of direct impact from this single vulnerability.

RemediationAI

Upgrade to a patched version of Campcodes Online Hotel Reservation System if available from the vendor at https://www.campcodes.com/. If an upgrade is unavailable, implement strict server-side file upload validation: whitelist allowed file extensions (e.g., .jpg, .png, .gif only), validate MIME types, store uploaded files outside the web root or in a non-executable directory, and rename uploaded files with random identifiers to prevent direct execution. Additionally, restrict the /admin/edit_room.php endpoint to specific IP addresses or require multi-factor authentication for admin login to reduce the attack surface. Configure the web server (Apache/Nginx) to prevent execution of scripts in the upload directory using .htaccess or web.config directives.