Library System
Monthly
A vulnerability was determined in code-projects Library System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Library System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
We are tasked with producing a comprehensive JSON analysis for CVE-2025-7413. The analysis must synthesize data from multiple intelligence sources. We'll go through each field carefully. First, understand the CVE: It's a critical vulnerability in "code-projects Library System 1.0", specifically in /user/teacher/profile.php where manipulation of the argument "image" leads to unrestricted upload. It is remotely exploitable. The exploit is publicly disclosed. The CVSS Score is 2.1 (sounds very low, but the vector is 4.0: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P). That suggests low impact, but the description says "critical". Might be a discrepancy. CWE-284 is "Improper Access Control". Multi-source intelligence: EPSS 0.07% (percentile 21%), so low exploitation probability. POC/Exploit: Publicly available (from the description and tags). KEV status not mentioned, so assume not in KEV. Tags: File Upload, PHP, Authentication Bypass. CPE: code-projects:library_system:1.0. The product is "Library System 1.0" by code-projects (likely a PHP web app). References: - code-projects.org (probably the product site) - https://github.com/rom4j/cve/issues/16 (exploit reference) - vuldb.com links (including one with id.315873) - nvd link for CVE-2025-7413 We need to output fields as plain text strings, no arrays. So each field will be a paragraph. We'll follow the instructions precisely. product_name: "Library System" (but it's "Library System 1.0", so maybe "Library System" or "code-projects Library System"? The rule: "1-3 words ONLY. The specific product or service name affected." So "Library System" is appropriate, but to be specific, "code-projects Library System" might be 3 words. I'll use "Library System" as the vendor is "code-projects" and that is implied. But I'll go with "code-projects Library System" to be specific, but it's 3 words. I'll keep it simple: "Library System". It's better to specify "Library System" as the product, vendor known from CPE. I'll output: "Library System". summary: 2-3 sentence plain-language synthesis. Must not copy description, original. Start with impact and product. Example: "Remote code execution in Apache Tomcat 9.x allows..." But here it's unrestricted file upload, which could lead to code execution, but the CVSS impact is low (L:L:L). Description says "critical" though. The impact is "unrestricted upload leads to ..." Possibly webshell upload, leading to code execution. Since it's a PHP file upload, likely you can upload a PHP script and execute it. But the CVSS says VC:L/VI:L/VA:L, so low impact on confidentiality, integrity, availability. Might be that the uploaded image is only accessible within the teacher profile and can't be executed as code? But typical unrestricted upload in PHP allows code execution if the file is accessible. I'll note that: "Unrestricted file upload in code-projects Library System 1.0 via /user/teacher/profile.php allows authenticated remote attackers to upload arbitrary files, potentially leading to remote code execution. The vulnerability is due to improper access control (CWE-284) on the image upload parameter, and exploit code is publicly available." No active exploitation indicated, EPSS low. So summary: "Unrestricted file upload in code-projects Library System 1.0 allows authenticated attackers to upload arbitrary files via the 'image' parameter in /user/teacher/profile.php. Exploit code is publicly available, but the EPSS exploitation probability is low (0.07%), and no active exploitation has been reported in threat intelligence feeds." Note: CVSS vector gives PR:L, so authenticated as a low-privileged user (teacher). So "authenticated remote attacker" is appropriate. I'll mention the conditions: requires authentication as a teacher (or low privilege) and access to the profile page. Now technical_context: Explain the underlying technology. It's a PHP application, so file upload vulnerability. CWE-284, improper access control, likely missing checks on file type or permissions. CPE indicates "code-projects:library_system:1.0". The code-projects Library System is a PHP-based web application. The affected component is /user/teacher/profile.php, likely handling teacher profile updates including an image upload. The vulnerability arises because the application does not properly restrict what files can be uploaded, allowing an attacker to upload a malicious script (e.g., PHP webshell) that can be executed on the server. This could lead to further compromise. Reference CWE-284: improper access control, so maybe the file upload feature lacks proper authorization or validation, but the description says "unrestricted upload", more like CWE-434 (unrestricted upload of file with dangerous type), but they classified as CWE-284. I'll mention that. Underlying technology: PHP, web server (Apache/Nginx), typical LAMP stack. The upload endpoint likely stores uploaded files in a web-accessible directory, allowing direct execution of uploaded PHP files. So the root cause is insufficient file validation and lack of access control on the upload directory. This is a classic unrestricted file upload leading to remote code execution. risk_assessment: Use CVSS vector and EPSS to assess real risk. CVSS:4.0 vector shows AV:N (network), AC:L, AT:N, PR:L (low privileges required), UI:N, with low impact on all three aspects. The EPSS is low (0.07%), implying low probability of exploitation in the wild. No KEV listing, but POC available. So even though the vulnerability allows file upload, the real-world risk might be moderate because exploitation requires authentication as a teacher (PR:L) and the application is not widely deployed (we'll gauge prevalence). The CVSS score of 2.1 seems inconsistent with the description of "critical", but the numeric score given is likely for the exact impact (low). I'll mention this discrepancy: "CVSS:4.0 base score of 2.1 suggests low overall severity due to limited impact (VC:L/VI:L/VA:L) despite network attack vector and low attack complexity. However, unrestricted file upload in PHP can often lead to full code execution, so the actual impact may be higher depending on server configuration. The EPSS score is very low, indicating that widespread exploitation is unlikely. The availability of a POC does not currently translate into active exploitation." Also note PR:L means an attacker must first obtain teacher-level credentials. So risk is low for most organizations unless the Library System is exposed. Then "If any key data is missing or conflicting, STATE IT EXPLICITLY." Here, the CVSS vector suggests low impact while description says critical, and typical unrestricted upload can lead to code execution. I'll explicitly state: "The assigned CVSS:4.0 vector indicates low impact (VC:L, VI:L, VA:L) which contradicts the typical severity of unrestricted file upload vulnerabilities in PHP. This may be due to a misassessment or the specific deployment default configuration limiting impact. Organizations should verify whether the uploaded files are executed as PHP scripts in the affected version." affected_products: "code-projects Library System version 1.0, as identified by CPE cpe:2.3:a:code-projects:library_system:1.0:*:*:*:*:*:*:*. The vulnerable file is /user/teacher/profile.php. The product source is available from code-projects.org. No vendor advisory has been published; the vulnerability was reported through VulDB and EUVD, and an exploit is available on GitHub (rom4j/cve issues/16)." remediation: "No official vendor patch has been released as of analysis. As a workaround, restrict access to the upload directory by configuring the web server to deny execution of scripts from the upload location (e.g., using .htaccess ‘php_flag engine off’ or equivalent), or disable the teacher profile image upload feature entirely if not required. Additionally, implement strict file type validation on the server side to only allow image file extensions. However, these mitigations may break intended functionality. Monitor for any upcoming patches from the vendor via the VulDB advisory (https://vuldb.com/?id.315873)." Note: I'm not sure if a patch exists, but from the references, no advisory with a fix version. So I'll say "No vendor-released patch identified". I'll avoid saying "no patch exists". Suggest compensating controls. exploit_scenario: "An attacker with low-privileged teacher credentials (e.g., gained through phishing or default credentials) accesses the /user/teacher/profile.php page and uploads a malicious PHP webshell via the image upload field. The uploaded file is stored in a web-accessible directory, and the attacker navigates to it to execute arbitrary commands on the server, potentially taking full control of the web application and underlying host." Note: POC available from GitHub. exploitation_conditions: Must extract specific prerequisites. The description: "manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely." It doesn't mention authentication explicitly, but CVSS vector says PR:L, so low privileges required. The affected file is /user/teacher/profile.php, implying a teacher user must be logged in to access this endpoint. So conditions: "Exploitation requires authentication as a teacher-level user on the Library System application, with access to the profile image upload feature. No additional non-default configuration is needed—the vulnerability exists in the default installation of Library System 1.0. The attack is remotely exploitable over a network, but low privileges are mandatory." So I'll state: "Requires teacher-level authentication (PR:L) and access to the /user/teacher/profile.php upload form. No other special conditions; the default configuration is vulnerable." The instruction forbids generic phrases like "Network access required." So I'll be specific. I'll also note what limits it: authentication. So: "The vulnerability is limited to authenticated teacher users; unauthenticated attackers cannot exploit it directly unless they obtain valid credentials." That's good. attack_chain: A realistic chain: "Obtain teacher credentials → Access teacher profile page → Upload PHP webshell via image parameter → Locate uploaded file in web root → Execute webshell to achieve code execution → Escalate privileges or maintain persistence." But the chain should be concise, 3-7 steps separated by arrows. Starting from access: "Access with teacher credentials" is access. Then "Send malicious file via image upload" → "Web server stores file in public directory" → "Attacker requests uploaded PHP file" → "Server executes script" → "Attacker gains command execution". I'll combine into steps: "Authenticate as teacher → Upload PHP webshell via profile image parameter → Access uploaded file via direct URL → Execute arbitrary code on server". That's 4 steps. But maybe include persistence: "Authenticate → Upload → Access → Execute code → Install backdoor". But I'll keep it simple: "Authenticate as low-privileged teacher → Craft HTTP POST request with malicious PHP file to /user/teacher/profile.php → Server stores file in web-accessible directory → Attacker requests the file URL → PHP code executes, delivering a webshell → Attacker interacts with webshell for full remote control." That's 6 steps. Short steps: "Obtain teacher credentials (phishing/default) → Upload PHP shell via profile image upload → Determine file storage path → Execute webshell via HTTP request → Gain command execution → Maintain access." I'd like to follow kill chain phases. I'll produce: "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". That's 6 steps. I'll use exactly that as a string with arrows. No numbering. "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". Good. confidence_notes: "The vulnerability is confirmed by VulDB and EUVD, with a publicly available exploit on GitHub. The CWE classification (CWE-284) and CVSS vector (4.0) are provided by the VulDB submitter; the low impact scores may not reflect the full potential of the flaw if uploaded PHP files are executable. No vendor advisory or patch has been published, and the exact behavior of file execution is not independently verified. EPSS data indicates very low exploitation probability, consistent with the product's niche deployment." prevalence: The product is "Library System", a project from code-projects.org. It's a free, likely small-scale library management system used by small institutions or for learning purposes. Not widely deployed like major enterprise software. So prevalence is "low" or "rare". I'll go with "low". Justification: "free open-source PHP app with limited enterprise footprint". Will output "low". prevalence_basis:
Unrestricted file upload in code-projects Library System 1.0 enables remote attackers to upload arbitrary files via the image parameter of /user/student/profile.php, potentially leading to full server compromise if combined with authentication bypass. Public exploit code is available, though EPSS indicates low exploitation probability (0.07%) and no active exploitation is recorded in CISA KEV. The CVSS 4.0 rating of 2.1 (Low) conflicts with the 'critical' classification in the disclosure, likely due to the authentication bypass tag increasing real-world impact.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /notapprove.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available; no evidence of active exploitation but the low EPSS score suggests limited real-world impact.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /approve.php. The flaw permits low-impact unauthorized data access, modification, or service disruption. Public exploit code is available, but the software is a small demo project with minimal enterprise presence.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Search parameter in /user/teacher/books.php. Exploit code is publicly available, but no active exploitation has been confirmed through CISA KEV, and EPSS scores indicate low weaponization likelihood.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-teacher.php, leading to unauthorized database access and potential data manipulation. A public exploit is available, though no active exploitation has been confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and an extremely low EPSS probability (0.06%).
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the idn parameter in teacher-issue-book.php, leading to unauthorized database access. An attacker can read, modify, or delete data, potentially compromising the entire application. Public exploit code is available, though active exploitation has not been confirmed.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-student.php, potentially leading to unauthorized database access or modification. Exploit code is publicly available, but CISA KEV does not list it as actively exploited, and EPSS suggests a low 0.06% probability of exploitation.
Unrestricted file upload in code-projects Library System 1.0 allows authenticated remote attackers with low privileges to upload arbitrary files via the image parameter in /add-book.php. A publicly available proof-of-concept exploit exists, potentially enabling remote code execution through webshell upload. EPSS score is low (0.09%), indicating low threat activity despite the ease of exploitation.
Unrestricted file upload in code-projects Library System 1.0's /profile.php allows authenticated remote attackers with low privileges to upload arbitrary files, likely resulting in remote code execution. Exploit code is publicly available, but active exploitation is not confirmed (no CISA KEV listing) and EPSS predicts a low exploitation probability (0.11%).
SQL injection in code-projects Library System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the phone parameter in /profile.php. The vulnerability has a publicly available proof-of-concept, though no active exploitation is confirmed and EPSS estimates low short-term exploitation probability (0.06%). Impact is limited per CVSS scoring, primarily posing a risk of data theft or tampering.
SQL injection in Code-Projects Library System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'reg' parameter in /student-issue-book.php. Public exploit code is available, enabling potential data tampering or unauthorized access. Despite a network attack vector, CVSS 4.0 rates overall severity as medium (5.5) due to limited impact.
A vulnerability was found in SourceCodester Home Clean Service System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Library System 1.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Library System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Library System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
We are tasked with producing a comprehensive JSON analysis for CVE-2025-7413. The analysis must synthesize data from multiple intelligence sources. We'll go through each field carefully. First, understand the CVE: It's a critical vulnerability in "code-projects Library System 1.0", specifically in /user/teacher/profile.php where manipulation of the argument "image" leads to unrestricted upload. It is remotely exploitable. The exploit is publicly disclosed. The CVSS Score is 2.1 (sounds very low, but the vector is 4.0: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P). That suggests low impact, but the description says "critical". Might be a discrepancy. CWE-284 is "Improper Access Control". Multi-source intelligence: EPSS 0.07% (percentile 21%), so low exploitation probability. POC/Exploit: Publicly available (from the description and tags). KEV status not mentioned, so assume not in KEV. Tags: File Upload, PHP, Authentication Bypass. CPE: code-projects:library_system:1.0. The product is "Library System 1.0" by code-projects (likely a PHP web app). References: - code-projects.org (probably the product site) - https://github.com/rom4j/cve/issues/16 (exploit reference) - vuldb.com links (including one with id.315873) - nvd link for CVE-2025-7413 We need to output fields as plain text strings, no arrays. So each field will be a paragraph. We'll follow the instructions precisely. product_name: "Library System" (but it's "Library System 1.0", so maybe "Library System" or "code-projects Library System"? The rule: "1-3 words ONLY. The specific product or service name affected." So "Library System" is appropriate, but to be specific, "code-projects Library System" might be 3 words. I'll use "Library System" as the vendor is "code-projects" and that is implied. But I'll go with "code-projects Library System" to be specific, but it's 3 words. I'll keep it simple: "Library System". It's better to specify "Library System" as the product, vendor known from CPE. I'll output: "Library System". summary: 2-3 sentence plain-language synthesis. Must not copy description, original. Start with impact and product. Example: "Remote code execution in Apache Tomcat 9.x allows..." But here it's unrestricted file upload, which could lead to code execution, but the CVSS impact is low (L:L:L). Description says "critical" though. The impact is "unrestricted upload leads to ..." Possibly webshell upload, leading to code execution. Since it's a PHP file upload, likely you can upload a PHP script and execute it. But the CVSS says VC:L/VI:L/VA:L, so low impact on confidentiality, integrity, availability. Might be that the uploaded image is only accessible within the teacher profile and can't be executed as code? But typical unrestricted upload in PHP allows code execution if the file is accessible. I'll note that: "Unrestricted file upload in code-projects Library System 1.0 via /user/teacher/profile.php allows authenticated remote attackers to upload arbitrary files, potentially leading to remote code execution. The vulnerability is due to improper access control (CWE-284) on the image upload parameter, and exploit code is publicly available." No active exploitation indicated, EPSS low. So summary: "Unrestricted file upload in code-projects Library System 1.0 allows authenticated attackers to upload arbitrary files via the 'image' parameter in /user/teacher/profile.php. Exploit code is publicly available, but the EPSS exploitation probability is low (0.07%), and no active exploitation has been reported in threat intelligence feeds." Note: CVSS vector gives PR:L, so authenticated as a low-privileged user (teacher). So "authenticated remote attacker" is appropriate. I'll mention the conditions: requires authentication as a teacher (or low privilege) and access to the profile page. Now technical_context: Explain the underlying technology. It's a PHP application, so file upload vulnerability. CWE-284, improper access control, likely missing checks on file type or permissions. CPE indicates "code-projects:library_system:1.0". The code-projects Library System is a PHP-based web application. The affected component is /user/teacher/profile.php, likely handling teacher profile updates including an image upload. The vulnerability arises because the application does not properly restrict what files can be uploaded, allowing an attacker to upload a malicious script (e.g., PHP webshell) that can be executed on the server. This could lead to further compromise. Reference CWE-284: improper access control, so maybe the file upload feature lacks proper authorization or validation, but the description says "unrestricted upload", more like CWE-434 (unrestricted upload of file with dangerous type), but they classified as CWE-284. I'll mention that. Underlying technology: PHP, web server (Apache/Nginx), typical LAMP stack. The upload endpoint likely stores uploaded files in a web-accessible directory, allowing direct execution of uploaded PHP files. So the root cause is insufficient file validation and lack of access control on the upload directory. This is a classic unrestricted file upload leading to remote code execution. risk_assessment: Use CVSS vector and EPSS to assess real risk. CVSS:4.0 vector shows AV:N (network), AC:L, AT:N, PR:L (low privileges required), UI:N, with low impact on all three aspects. The EPSS is low (0.07%), implying low probability of exploitation in the wild. No KEV listing, but POC available. So even though the vulnerability allows file upload, the real-world risk might be moderate because exploitation requires authentication as a teacher (PR:L) and the application is not widely deployed (we'll gauge prevalence). The CVSS score of 2.1 seems inconsistent with the description of "critical", but the numeric score given is likely for the exact impact (low). I'll mention this discrepancy: "CVSS:4.0 base score of 2.1 suggests low overall severity due to limited impact (VC:L/VI:L/VA:L) despite network attack vector and low attack complexity. However, unrestricted file upload in PHP can often lead to full code execution, so the actual impact may be higher depending on server configuration. The EPSS score is very low, indicating that widespread exploitation is unlikely. The availability of a POC does not currently translate into active exploitation." Also note PR:L means an attacker must first obtain teacher-level credentials. So risk is low for most organizations unless the Library System is exposed. Then "If any key data is missing or conflicting, STATE IT EXPLICITLY." Here, the CVSS vector suggests low impact while description says critical, and typical unrestricted upload can lead to code execution. I'll explicitly state: "The assigned CVSS:4.0 vector indicates low impact (VC:L, VI:L, VA:L) which contradicts the typical severity of unrestricted file upload vulnerabilities in PHP. This may be due to a misassessment or the specific deployment default configuration limiting impact. Organizations should verify whether the uploaded files are executed as PHP scripts in the affected version." affected_products: "code-projects Library System version 1.0, as identified by CPE cpe:2.3:a:code-projects:library_system:1.0:*:*:*:*:*:*:*. The vulnerable file is /user/teacher/profile.php. The product source is available from code-projects.org. No vendor advisory has been published; the vulnerability was reported through VulDB and EUVD, and an exploit is available on GitHub (rom4j/cve issues/16)." remediation: "No official vendor patch has been released as of analysis. As a workaround, restrict access to the upload directory by configuring the web server to deny execution of scripts from the upload location (e.g., using .htaccess ‘php_flag engine off’ or equivalent), or disable the teacher profile image upload feature entirely if not required. Additionally, implement strict file type validation on the server side to only allow image file extensions. However, these mitigations may break intended functionality. Monitor for any upcoming patches from the vendor via the VulDB advisory (https://vuldb.com/?id.315873)." Note: I'm not sure if a patch exists, but from the references, no advisory with a fix version. So I'll say "No vendor-released patch identified". I'll avoid saying "no patch exists". Suggest compensating controls. exploit_scenario: "An attacker with low-privileged teacher credentials (e.g., gained through phishing or default credentials) accesses the /user/teacher/profile.php page and uploads a malicious PHP webshell via the image upload field. The uploaded file is stored in a web-accessible directory, and the attacker navigates to it to execute arbitrary commands on the server, potentially taking full control of the web application and underlying host." Note: POC available from GitHub. exploitation_conditions: Must extract specific prerequisites. The description: "manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely." It doesn't mention authentication explicitly, but CVSS vector says PR:L, so low privileges required. The affected file is /user/teacher/profile.php, implying a teacher user must be logged in to access this endpoint. So conditions: "Exploitation requires authentication as a teacher-level user on the Library System application, with access to the profile image upload feature. No additional non-default configuration is needed—the vulnerability exists in the default installation of Library System 1.0. The attack is remotely exploitable over a network, but low privileges are mandatory." So I'll state: "Requires teacher-level authentication (PR:L) and access to the /user/teacher/profile.php upload form. No other special conditions; the default configuration is vulnerable." The instruction forbids generic phrases like "Network access required." So I'll be specific. I'll also note what limits it: authentication. So: "The vulnerability is limited to authenticated teacher users; unauthenticated attackers cannot exploit it directly unless they obtain valid credentials." That's good. attack_chain: A realistic chain: "Obtain teacher credentials → Access teacher profile page → Upload PHP webshell via image parameter → Locate uploaded file in web root → Execute webshell to achieve code execution → Escalate privileges or maintain persistence." But the chain should be concise, 3-7 steps separated by arrows. Starting from access: "Access with teacher credentials" is access. Then "Send malicious file via image upload" → "Web server stores file in public directory" → "Attacker requests uploaded PHP file" → "Server executes script" → "Attacker gains command execution". I'll combine into steps: "Authenticate as teacher → Upload PHP webshell via profile image parameter → Access uploaded file via direct URL → Execute arbitrary code on server". That's 4 steps. But maybe include persistence: "Authenticate → Upload → Access → Execute code → Install backdoor". But I'll keep it simple: "Authenticate as low-privileged teacher → Craft HTTP POST request with malicious PHP file to /user/teacher/profile.php → Server stores file in web-accessible directory → Attacker requests the file URL → PHP code executes, delivering a webshell → Attacker interacts with webshell for full remote control." That's 6 steps. Short steps: "Obtain teacher credentials (phishing/default) → Upload PHP shell via profile image upload → Determine file storage path → Execute webshell via HTTP request → Gain command execution → Maintain access." I'd like to follow kill chain phases. I'll produce: "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". That's 6 steps. I'll use exactly that as a string with arrows. No numbering. "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". Good. confidence_notes: "The vulnerability is confirmed by VulDB and EUVD, with a publicly available exploit on GitHub. The CWE classification (CWE-284) and CVSS vector (4.0) are provided by the VulDB submitter; the low impact scores may not reflect the full potential of the flaw if uploaded PHP files are executable. No vendor advisory or patch has been published, and the exact behavior of file execution is not independently verified. EPSS data indicates very low exploitation probability, consistent with the product's niche deployment." prevalence: The product is "Library System", a project from code-projects.org. It's a free, likely small-scale library management system used by small institutions or for learning purposes. Not widely deployed like major enterprise software. So prevalence is "low" or "rare". I'll go with "low". Justification: "free open-source PHP app with limited enterprise footprint". Will output "low". prevalence_basis:
Unrestricted file upload in code-projects Library System 1.0 enables remote attackers to upload arbitrary files via the image parameter of /user/student/profile.php, potentially leading to full server compromise if combined with authentication bypass. Public exploit code is available, though EPSS indicates low exploitation probability (0.07%) and no active exploitation is recorded in CISA KEV. The CVSS 4.0 rating of 2.1 (Low) conflicts with the 'critical' classification in the disclosure, likely due to the authentication bypass tag increasing real-world impact.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /notapprove.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available; no evidence of active exploitation but the low EPSS score suggests limited real-world impact.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /approve.php. The flaw permits low-impact unauthorized data access, modification, or service disruption. Public exploit code is available, but the software is a small demo project with minimal enterprise presence.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Search parameter in /user/teacher/books.php. Exploit code is publicly available, but no active exploitation has been confirmed through CISA KEV, and EPSS scores indicate low weaponization likelihood.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-teacher.php, leading to unauthorized database access and potential data manipulation. A public exploit is available, though no active exploitation has been confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and an extremely low EPSS probability (0.06%).
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the idn parameter in teacher-issue-book.php, leading to unauthorized database access. An attacker can read, modify, or delete data, potentially compromising the entire application. Public exploit code is available, though active exploitation has not been confirmed.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-student.php, potentially leading to unauthorized database access or modification. Exploit code is publicly available, but CISA KEV does not list it as actively exploited, and EPSS suggests a low 0.06% probability of exploitation.
Unrestricted file upload in code-projects Library System 1.0 allows authenticated remote attackers with low privileges to upload arbitrary files via the image parameter in /add-book.php. A publicly available proof-of-concept exploit exists, potentially enabling remote code execution through webshell upload. EPSS score is low (0.09%), indicating low threat activity despite the ease of exploitation.
Unrestricted file upload in code-projects Library System 1.0's /profile.php allows authenticated remote attackers with low privileges to upload arbitrary files, likely resulting in remote code execution. Exploit code is publicly available, but active exploitation is not confirmed (no CISA KEV listing) and EPSS predicts a low exploitation probability (0.11%).
SQL injection in code-projects Library System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the phone parameter in /profile.php. The vulnerability has a publicly available proof-of-concept, though no active exploitation is confirmed and EPSS estimates low short-term exploitation probability (0.06%). Impact is limited per CVSS scoring, primarily posing a risk of data theft or tampering.
SQL injection in Code-Projects Library System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'reg' parameter in /student-issue-book.php. Public exploit code is available, enabling potential data tampering or unauthorized access. Despite a network attack vector, CVSS 4.0 rates overall severity as medium (5.5) due to limited impact.
A vulnerability was found in SourceCodester Home Clean Service System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Library System 1.0 and classified as critical.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Library System 1.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability classified as critical has been found in SourceCodester Library System 1.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.