CVE-2025-11103: Online Tours And Travels RCE Vulnerability

CVE-2025-11103 Overview

CVE-2025-11103 is an unrestricted file upload vulnerability in Projectworlds Online Tours and Travels 1.0. The flaw resides in /admin/change-image.php, where the packageimage parameter does not validate uploaded file types or content. An authenticated administrator-level attacker can upload arbitrary files, including server-side scripts, to the application. The vulnerability is remotely exploitable over the network and the exploit has been disclosed publicly. The weakness is classified under [CWE-284: Improper Access Control]. While the CVSS score is low due to the requirement for high privileges, the exploit details are available in public references including a GitHub issue and VulDB submissions.

Critical Impact
A remote authenticated attacker can upload arbitrary files through /admin/change-image.php, potentially leading to web shell deployment and follow-on code execution on the affected host.

Affected Products

Projectworlds Online Tours and Travels 1.0
Component: /admin/change-image.php
Parameter: packageimage

Discovery Timeline

2025-09-28 - CVE-2025-11103 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11103

Vulnerability Analysis

The vulnerability exists in the administrative image change handler at /admin/change-image.php. The script accepts an uploaded file via the packageimage argument without enforcing MIME type, extension, or content-based validation. As a result, an attacker with administrative access can submit files with executable server-side extensions such as .php instead of legitimate image types. Once stored under the web root, these files become directly reachable through standard HTTP requests. The exploit has been disclosed publicly, increasing the likelihood of opportunistic targeting against exposed deployments. EPSS data indicates a low near-term exploitation probability, but the public disclosure means working exploitation primitives are documented.

Root Cause

The root cause is missing access control and input validation on the file upload routine. The handler trusts the client-supplied filename and content for packageimage and writes the data to a publicly served directory. There is no allow-list of permitted extensions, no MIME sniffing, and no rewriting of the stored filename to a non-executable form. This matches the [CWE-284] improper access control pattern applied to upload functionality.

Attack Vector

Exploitation requires an authenticated session with administrative privileges on the application. The attacker submits a multipart POST request to /admin/change-image.php with the packageimage field containing a script payload. After upload, the attacker requests the stored file via its predictable path, causing the web server to execute the embedded code. No user interaction is required beyond the attacker's own session.

The vulnerability mechanics are documented in the public references. See the GitHub Issue for CVE-2025-11103 and the VulDB entry #326184 for technical details.

Detection Methods for CVE-2025-11103

Indicators of Compromise

POST requests to /admin/change-image.php containing packageimage form fields where the filename or content-type does not match a standard image format.
New files with executable extensions (.php, .phtml, .phar) appearing in upload or package image directories.
Outbound connections originating from the PHP-FPM or web server worker process to unfamiliar destinations following an upload event.

Detection Strategies

Monitor web server access logs for change-image.php requests followed shortly by direct GET requests to newly created files in image upload paths.
Apply web application firewall rules that inspect multipart uploads to the admin endpoint and block non-image MIME types or polyglot files.
Use file integrity monitoring on the application's image storage directory to alert on creation of files with script extensions.

Monitoring Recommendations

Enable verbose logging on the administrative interface and forward authentication events and upload activity to a centralized SIEM.
Correlate admin authentication events with subsequent upload operations to detect post-compromise abuse of legitimate accounts.
Track process lineage from the web server user to spot unexpected child processes spawned after upload activity.

How to Mitigate CVE-2025-11103

Immediate Actions Required

Restrict administrative access to /admin/ paths using network-level controls, VPN, or IP allow-listing until a fix is applied.
Rotate all administrative credentials for Projectworlds Online Tours and Travels deployments, since the exploit requires authenticated admin access.
Audit the image upload directory for files with non-image extensions and remove any unauthorized artifacts.

Patch Information

No vendor advisory or official patch has been published for CVE-2025-11103 at the time of writing. Operators should contact Projectworlds directly or apply application-layer mitigations and source-level fixes. The recommended source fix is to validate uploaded files against an extension and MIME allow-list, store uploads outside the web root, and rename files to non-executable identifiers on save.

Workarounds

Configure the web server to refuse execution of PHP files within the image upload directory using directives such as Apache php_admin_flag engine off or an equivalent Nginx location block.
Place a reverse proxy or WAF rule in front of /admin/change-image.php that rejects uploads where the file content does not begin with a valid image magic number.
Disable the affected administrative endpoint if image management is not required for production operation.

bash

# Example Apache configuration to disable PHP execution in upload directory
<Directory "/var/www/html/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar
    Options -ExecCGI
</Directory>