EUVD-2026-25872Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible PHP endpoint requires high-privilege authentication (PR:H); impacts rated Low across C/I/A reflecting constrained scope without confirmed code execution path.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was identified in code-projects Online Lot Reservation System 1.0. Affected is an unknown function of the file /edithousepic.php. Such manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.
AnalysisAI
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 allows an authenticated high-privilege user to upload arbitrary file types via the image parameter in /edithousepic.php, potentially enabling server-side code execution if the upload directory permits PHP execution. A publicly available proof-of-concept exploit exists on GitHub, though no active exploitation has been confirmed via CISA KEV. The mandatory high-privilege authentication barrier (PR:H per CVSS 4.0) substantially constrains the real-world attack surface despite the network-accessible vector.
Technical ContextAI
CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the PHP endpoint /edithousepic.php accepts user-supplied files via the image parameter without performing server-side validation of file type, extension, or content (magic bytes). The affected product is code-projects Online Lot Reservation System 1.0 (CPE: cpe:2.3:a:code-projects:online_lot_reservation_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing lot reservations. In classic CWE-434 exploitation, an attacker uploads a PHP webshell with a benign file extension that bypasses any client-side or weak server-side checks; if the upload directory is web-accessible and the web server does not restrict script execution within it, the uploaded file can be requested directly to execute arbitrary server-side commands. The wildcard version in the CPE string suggests the scope may extend to other versions, but only 1.0 is explicitly confirmed by EUVD data.
RemediationAI
No vendor-released patch has been identified at time of analysis for Online Lot Reservation System 1.0; patch status cannot be confirmed from the available references (VulDB, GitHub POC, and vendor site only). As the primary compensating control, restrict PHP execution within the upload directory by adding an .htaccess rule (e.g., php_flag engine off) or equivalent server configuration - this prevents uploaded webshells from executing even if successfully uploaded, reducing impact from potential RCE to mere file storage. A second control is to implement server-side MIME type validation using PHP's finfo_file() to verify actual file content against allowed image types (JPEG, PNG, GIF), rejecting any upload where the magic bytes do not match; note this requires code modification and is not a configuration-only fix. Additionally, restricting access to /edithousepic.php at the web server or firewall layer to only known administrative IP ranges reduces exposure without code changes. If the house picture editing feature is not operationally required, disabling or removing /edithousepic.php entirely eliminates the attack surface. Enforce strong, unique credentials for all administrative accounts to prevent credential-based bypass of the PR:H barrier. Monitor vendor communications at https://code-projects.org/ for a formal patch release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today