CVE-2025-11352: Hotel Reservation System RCE Vulnerability

CVE-2025-11352 Overview

CVE-2025-11352 is an unrestricted file upload vulnerability in code-projects Online Hotel Reservation System 1.0. The flaw resides in the /admin/addexec.php script, where the image parameter accepts attacker-controlled input without proper validation. An authenticated remote attacker with low privileges can manipulate the upload to place arbitrary files on the server. The issue is classified under CWE-284 (Improper Access Control). Public disclosure has occurred through VulDB and a GitHub issue, making exploit techniques available to threat actors.

Critical Impact
Authenticated attackers can upload arbitrary files via the image parameter in addexec.php, potentially leading to web shell deployment and server compromise.

Affected Products

Fabian Online Hotel Reservation System 1.0
The /admin/addexec.php endpoint
Any deployment exposing the admin interface to untrusted networks

Discovery Timeline

2025-10-07 - CVE-2025-11352 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11352

Vulnerability Analysis

The vulnerability exists in the administrative file upload handler at /admin/addexec.php. The script processes the image argument without enforcing content-type validation, file extension allow-listing, or magic-byte verification. As a result, attackers can submit files containing server-side script content disguised as image uploads.

The attack requires only low-privileged authentication, which is consistent with the application exposing an administrative panel that lacks layered access control. Once an arbitrary file lands in a web-accessible directory, the attacker can request it via HTTP and trigger code execution in the PHP context.

The issue is tracked under CWE-284, reflecting the absence of restrictions on the file upload operation. Although the calculated severity is low, the practical outcome is full compromise of the application and any data it stores.

Root Cause

The upload handler in addexec.php accepts user-controlled file data through the image parameter and writes it to disk without validating the file type, extension, or contents. Server-side enforcement of allowed MIME types and extensions is missing.

Attack Vector

A remote attacker authenticates to the admin area with valid low-privilege credentials, then submits a crafted multipart upload to /admin/addexec.php. By naming the payload with a PHP extension and supplying script content in place of an image, the attacker gains the ability to execute arbitrary commands by requesting the uploaded file. See the VulDB entry #327237 and the GitHub issue discussion for additional technical context.

Detection Methods for CVE-2025-11352

Indicators of Compromise

POST requests to /admin/addexec.php containing image form fields with non-image extensions such as .php, .phtml, or .phar
Newly created files in upload directories with executable script extensions and recent modification timestamps
Web server access logs showing GET requests to attacker-uploaded files in image storage paths
Outbound network connections initiated by the web server process shortly after an upload event

Detection Strategies

Monitor file integrity in upload directories and alert on files whose extensions do not match expected media types
Inspect HTTP request bodies for PHP tags (<?php) or shell command patterns inside multipart uploads
Correlate admin login events with subsequent uploads and follow-on execution of unfamiliar scripts

Monitoring Recommendations

Enable verbose access logging on the admin path and forward logs to a centralized analytics platform
Track process creation events from the web server user, focusing on shells, interpreters, and reconnaissance utilities
Review authentication logs for the admin panel to identify credential stuffing or brute-force activity preceding uploads

How to Mitigate CVE-2025-11352

Immediate Actions Required

Restrict access to /admin/ paths using IP allow-listing or VPN-only access until a patched version is available
Audit the upload directory for unauthorized script files and remove any unexpected content
Rotate administrative credentials and enforce strong password policies for accounts with access to the admin panel
Disable PHP execution in directories used to store user-uploaded media

Patch Information

No vendor patch has been published for code-projects Online Hotel Reservation System 1.0. The product is distributed through the Code Projects resource hub, and operators should monitor the project page for fixes. Where no fix is forthcoming, consider migrating to a maintained reservation platform.

Workarounds

Configure the web server to disallow execution of scripts within upload directories using rules such as php_admin_flag engine off for Apache or appropriate location blocks in nginx
Add a web application firewall rule that rejects multipart uploads containing PHP opening tags or executable extensions
Implement server-side extension and MIME validation in a reverse proxy layer if source modifications are not feasible
Remove or disable the addexec.php endpoint if it is not required for daily operations

bash

# Configuration example: disable PHP execution in upload directory (Apache)
<Directory "/var/www/html/admin/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar .php3 .php4 .php5
    Options -ExecCGI
</Directory>