CVE-2025-11353: Fabian Hotel Reservation System RCE Flaw

CVE-2025-11353 Overview

CVE-2025-11353 affects code-projects Online Hotel Reservation System 1.0, a PHP-based hotel booking application. The vulnerability resides in /admin/addgalleryexec.php and stems from improper access control [CWE-284] over the image parameter. An authenticated remote attacker can manipulate this parameter to upload arbitrary files without restriction. Public exploitation details are available, increasing the risk of opportunistic attacks against exposed deployments.

Critical Impact
Authenticated attackers can upload arbitrary files to the gallery endpoint, potentially placing executable PHP content within the web root and gaining server-side code execution on vulnerable Online Hotel Reservation System 1.0 installations.

Affected Products

Fabian Online Hotel Reservation System 1.0
Deployments referencing /admin/addgalleryexec.php
CPE: cpe:2.3:a:fabian:online_hotel_reservation_system:1.0

Discovery Timeline

2025-10-07 - CVE-2025-11353 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11353

Vulnerability Analysis

The vulnerability exists in the gallery upload handler at /admin/addgalleryexec.php. The script accepts the image argument from administrative gallery submissions and writes the supplied file to disk without enforcing extension, MIME type, or content validation. This classifies as unrestricted file upload mapped to improper access control [CWE-284]. The flaw is reachable over the network with low-privilege authentication and does not require user interaction.

Because the application is written in PHP and the upload destination typically resides under the web root, an attacker can place a .php payload and request it directly through the web server. The CVSS 4.0 vector indicates low confidentiality, integrity, and availability impact at the vulnerable system scope, though real-world impact depends on server configuration and execution permissions in the gallery directory.

Root Cause

The root cause is the absence of server-side validation on the uploaded file. The handler does not verify the file extension against an allowlist, does not validate the MIME type, and does not perform magic-byte inspection. Administrative access controls on the endpoint also fail to constrain upload contents, allowing any authenticated session to drop arbitrary files into a web-accessible location.

Attack Vector

The attack vector is network-based. An attacker who possesses or obtains low-privilege administrative credentials submits a crafted multipart request to /admin/addgalleryexec.php with a malicious image field. The payload is a PHP file disguised with an image extension or carrying a valid .php extension. The attacker then requests the stored file URL to trigger execution. Public exploit references are listed under VulDB entries 327238 and 664920 and a GitHub issue discussion. See the VulDB #327238 Details and GitHub Issue Discussion for reference material.

Detection Methods for CVE-2025-11353

Indicators of Compromise

POST requests to /admin/addgalleryexec.php containing multipart payloads with non-image extensions such as .php, .phtml, or .phar.
New files appearing under the gallery upload directory with executable server-side extensions or double extensions like image.jpg.php.
Web server access logs showing direct GET requests to recently uploaded gallery files that return PHP-generated content.
Outbound connections from the PHP-FPM or web server worker process to unfamiliar hosts following gallery uploads.

Detection Strategies

Monitor file integrity on the gallery upload directory and alert on creation of files with server-executable extensions.
Inspect web server logs for sequences of POST to addgalleryexec.php immediately followed by GET requests to newly created files.
Deploy WAF signatures that block uploads whose magic bytes do not match an allowed image format when the request targets the gallery endpoint.

Monitoring Recommendations

Enable verbose PHP and web server logging for the /admin/ path and forward events to a centralized SIEM.
Alert on PHP process spawning shell interpreters such as /bin/sh, bash, cmd.exe, or powershell.exe.
Track administrative authentication anomalies, including logins from new geolocations or user agents preceding gallery activity.

How to Mitigate CVE-2025-11353

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlists or VPN-only access until a patched build is available.
Rotate all administrative credentials for the Online Hotel Reservation System and audit recent administrative sessions.
Audit the gallery upload directory and remove any files that are not legitimate images, then verify web server logs for prior exploitation.
Disable PHP execution within the gallery upload directory using web server configuration.

Patch Information

No vendor patch is currently referenced in the advisory data. Organizations running Fabian Online Hotel Reservation System 1.0 should consult the Code Projects Resource for updates and consider replacing the affected upload handler with a validated implementation. Until an official fix is released, treat the application as exposed and apply the compensating controls below.

Workarounds

Add server-side validation in addgalleryexec.php to enforce an extension allowlist of .jpg, .jpeg, .png, and .gif, and verify magic bytes before writing the file.
Configure the web server to deny PHP execution in the gallery upload directory using an .htaccess rule or equivalent Nginx location block.
Rename uploaded files to randomized identifiers and strip user-supplied extensions to prevent direct execution paths.
Deploy a WAF rule that blocks multipart requests to addgalleryexec.php containing PHP tags or executable extensions.

bash

# Apache: deny PHP execution in the gallery upload directory
# Place this .htaccess inside the uploads/gallery/ folder
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|pht)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (server or location block)
location ^~ /uploads/gallery/ {
    location ~ \.(php|phtml|phar)$ {
        deny all;
        return 403;
    }
}