CVE-2025-11426: Library Management System RCE Vulnerability

CVE-2025-11426 Overview

CVE-2025-11426 is an unrestricted file upload vulnerability in Projectworlds Advanced Library Management System 1.0. The flaw resides in the /edit_book.php script, where the image parameter accepts attacker-controlled input without validation. Authenticated remote attackers can abuse this functionality to upload arbitrary files to the web server. The vulnerability maps to [CWE-434] Unrestricted Upload of File with Dangerous Type and [CWE-284] Improper Access Control. Public disclosure occurred through a GitHub issue tracker and VulDB entry #327361.

Critical Impact
Authenticated attackers can upload arbitrary files through edit_book.php, potentially leading to web shell deployment and remote code execution on the hosting server.

Affected Products

Projectworlds Advanced Library Management System 1.0
CPE: cpe:2.3:a:projectworlds:advanced_library_management_system:1.0:*:*:*:*:*:*:*
PHP-based deployments running the vulnerable edit_book.php endpoint

Discovery Timeline

2025-10-08 - CVE-2025-11426 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-11426

Vulnerability Analysis

The vulnerability exists in the book edit functionality of Projectworlds Advanced Library Management System. The /edit_book.php script processes an image parameter intended to update book cover images. The application does not validate file type, extension, or content before writing the uploaded file to disk. An attacker with low-privilege authenticated access can submit a multipart upload containing a PHP script disguised as an image. Once written to a web-accessible directory, the file can be requested directly to execute attacker-supplied code in the web server context. The combination of [CWE-434] and [CWE-284] indicates the upload functionality lacks both content validation and proper authorization checks. Refer to the VulDB advisory for additional context.

Root Cause

The root cause is missing server-side validation of uploaded file attributes. The handler accepts the image form field without inspecting MIME type, file extension allowlists, or magic byte signatures. The application also fails to enforce sufficient access controls on the edit endpoint, allowing low-privileged users to invoke file write operations.

Attack Vector

The attack is remote and requires low-privilege authentication. An attacker sends a crafted HTTP POST request to /edit_book.php with a malicious file in the image parameter. After upload, the attacker navigates to the resulting file path to trigger execution. EPSS data places exploitation probability at 0.295% with a percentile of 20.95. Technical details of the proof-of-concept appear in the public GitHub issue discussion.

Detection Methods for CVE-2025-11426

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) inside book image upload directories
POST requests to /edit_book.php containing multipart payloads where the image field carries non-image content
Web server processes spawning shells or outbound network connections following requests to upload directories
New or modified files in image storage paths with timestamps that do not correspond to legitimate librarian activity

Detection Strategies

Inspect web server access logs for POST requests to edit_book.php followed by GET requests to newly created files in image directories
Apply file integrity monitoring to upload directories and alert on creation of files with script extensions
Use web application firewall rules to inspect multipart upload content type headers against declared file extensions

Monitoring Recommendations

Forward PHP application logs and web server access logs to a centralized analytics platform for correlation
Monitor for PHP interpreter execution originating from user-writable directories
Track authentication events preceding upload activity to identify compromised or abused librarian accounts

How to Mitigate CVE-2025-11426

Immediate Actions Required

Restrict access to /edit_book.php to trusted administrative IP ranges until a fix is applied
Disable PHP execution in directories that store uploaded images using web server configuration
Audit existing upload directories for unauthorized files and remove any suspicious content
Rotate credentials for all accounts with edit privileges in the library management system

Patch Information

No vendor patch has been published for Projectworlds Advanced Library Management System 1.0 at the time of writing. No vendor advisory URLs are listed in the public CVE record. Organizations should consider replacing the application or applying source-level fixes to validate file uploads.

Workarounds

Implement an allowlist of image MIME types and extensions (.jpg, .jpeg, .png, .gif) in edit_book.php before writing files
Rename uploaded files to randomized identifiers and strip original extensions
Store uploads outside the web root and serve them through a controlled handler
Deploy a web application firewall rule that blocks multipart requests where the file content does not match the declared image type

bash

# Apache configuration to disable PHP execution in upload directory
<Directory "/var/www/library/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php[0-9])$">
        Require all denied
    </FilesMatch>
</Directory>