CVE-2025-11347: Crud Operation System RCE Vulnerability

CVE-2025-11347 Overview

A vulnerability has been identified in code-projects Student Crud Operation up to version 3.3 that allows unrestricted file upload through the add.php file. This vulnerability affects the move_uploaded_file function within the Add Student Page and Edit Student Page components. An attacker can remotely exploit this flaw by manipulating file uploads, potentially leading to remote code execution on the affected system.

Critical Impact
Unrestricted file upload vulnerability enables attackers to upload arbitrary files including malicious scripts, potentially leading to complete system compromise and remote code execution.

Affected Products

code-projects crud_operation_system up to version 3.3
Student Crud Operation - Add Student Page component
Student Crud Operation - Edit Student Page component

Discovery Timeline

October 7, 2025 - CVE-2025-11347 published to NVD
October 14, 2025 - Last updated in NVD database

Technical Details for CVE-2025-11347

Vulnerability Analysis

This unrestricted file upload vulnerability (CWE-434) combined with improper access control (CWE-284) exists in the Student Crud Operation application's file handling mechanism. The vulnerability is network-accessible and requires no authentication or user interaction to exploit. The move_uploaded_file function in add.php fails to properly validate uploaded files, allowing attackers to bypass security controls and upload arbitrary file types.

The public availability of exploit details increases the risk of active exploitation in the wild. Organizations using this student management system should treat this vulnerability with urgency, as successful exploitation could grant attackers the ability to execute arbitrary code on the web server.

Root Cause

The root cause of this vulnerability lies in improper input validation and missing file type restrictions in the file upload functionality. The application's move_uploaded_file function does not adequately verify that uploaded files conform to expected file types (such as images for student photos). This allows attackers to upload files with executable extensions like .php, which can then be accessed directly to execute malicious code on the server.

The lack of proper access control mechanisms (CWE-284) compounds this issue, as no authentication is required to access the vulnerable upload functionality.

Attack Vector

The attack can be initiated remotely over the network against the Add Student Page or Edit Student Page components. An attacker can craft a malicious file (such as a PHP web shell) disguised or presented as a legitimate upload. By submitting this file through the vulnerable add.php endpoint, the attacker can place executable code on the server. Once uploaded, the attacker can navigate to the uploaded file's location to trigger code execution, potentially gaining full control of the web application and underlying server.

The vulnerability does not require any authentication, making it accessible to any network attacker who can reach the application. For technical details on exploitation, refer to the GitHub PoC Repository.

Detection Methods for CVE-2025-11347

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .php5) appearing in upload directories
Web shell signatures or suspicious PHP files in student image/upload folders
HTTP POST requests to add.php containing non-image file content types
Unusual outbound connections or command execution from the web server process

Detection Strategies

Monitor web server logs for POST requests to add.php with suspicious payloads or unusual file extensions
Implement file integrity monitoring on upload directories to detect unauthorized file additions
Deploy web application firewall (WAF) rules to block uploads containing PHP code or other executable content
Review access logs for sequential patterns of file upload followed by direct file access requests

Monitoring Recommendations

Enable verbose logging for the web application to capture detailed upload request information
Configure intrusion detection systems to alert on web shell signatures and common exploitation patterns
Implement real-time file system monitoring on directories where uploaded files are stored
Establish baseline traffic patterns to identify anomalous upload activity to the affected endpoints

How to Mitigate CVE-2025-11347

Immediate Actions Required

Restrict or disable the file upload functionality in add.php until a patch is available
Implement strict file type validation, allowing only expected image formats (JPEG, PNG, GIF)
Add authentication requirements to the Add Student and Edit Student pages
Review upload directories for any suspicious or unexpected files and remove them immediately

Patch Information

No official vendor patch has been identified at this time. Organizations should monitor the Code Projects website for security updates. In the absence of an official patch, implementing the workarounds below is strongly recommended. Additional vulnerability details can be found at VulDB #327232.

Workarounds

Implement server-side file type validation using MIME type checking and file header verification
Rename uploaded files to random strings and store them outside the web root directory
Configure the web server to prevent execution of scripts in upload directories using .htaccess or server configuration
Deploy a web application firewall to filter malicious upload attempts

bash

# Apache .htaccess configuration to prevent PHP execution in uploads directory
# Place this file in your uploads directory
<Directory /path/to/uploads>
    php_admin_flag engine off
    AddHandler cgi-script .php .phtml .php5 .php7
    Options -ExecCGI
</Directory>