CVE-2025-11470: Hotel Management System RCE Vulnerability

CVE-2025-11470 Overview

CVE-2025-11470 is an unrestricted file upload vulnerability in the SourceCodester Hotel and Lodge Management System version 1.0, developed by nikhil-bhalerao. The flaw resides in the /manage_website.php script, where the website_image and back_login_image parameters accept attacker-controlled files without proper validation. An authenticated remote attacker can manipulate these parameters to upload arbitrary content to the server. The weakness is classified under [CWE-284] Improper Access Control. Public disclosure of the issue includes proof-of-concept details shared through VulDB and a GitHub issue tracker.

Critical Impact
Authenticated attackers can upload arbitrary files through manage_website.php, potentially staging webshells or malicious content on the hosting server.

Affected Products

Nikhil-bhalerao Hotel and Lodge Management System 1.0
SourceCodester distribution of Hotel and Lodge Management System
cpe:2.3:a:nikhil-bhalerao:hotel_and_lodge_management_system:1.0

Discovery Timeline

2025-10-08 - CVE-2025-11470 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11470

Vulnerability Analysis

The vulnerability exists in the website management functionality exposed by /manage_website.php. The script processes uploads for two parameters, website_image and back_login_image, which are intended to receive image assets for the application's front-end branding. The handler does not enforce sufficient restrictions on file type, extension, or content before storing the uploaded file inside the web-accessible directory.

Because the upload occurs over the network and requires only an authenticated session with elevated privileges, an attacker with valid management credentials can submit crafted files. The public exploit disclosure indicates that the attack succeeds remotely without user interaction. EPSS data places the probability of observed exploitation activity in the lower range, consistent with the limited deployment footprint of this open-source application.

Root Cause

The root cause is improper access control combined with missing content validation in the file upload handler of manage_website.php. The script trusts client-supplied metadata when processing the website_image and back_login_image fields. No allowlist of MIME types, no magic-byte inspection, and no extension normalization are applied before the file is written to disk.

Attack Vector

An authenticated administrator account submits a multipart POST request to /manage_website.php targeting the website_image or back_login_image form fields. Instead of a legitimate image, the attacker supplies a server-side script such as a PHP webshell renamed or crafted to bypass any superficial checks. Once stored under the web root, the attacker requests the file directly to trigger execution under the web server's privileges. Successful exploitation enables persistence, lateral access, and arbitrary command execution within the application context.

Detailed reproduction notes are available in the GitHub Issue Discussion and the VulDB entry #327588.

Detection Methods for CVE-2025-11470

Indicators of Compromise

Unexpected .php, .phtml, or double-extension files (e.g., image.php.jpg) within the upload directories used by manage_website.php.
POST requests to /manage_website.php containing website_image or back_login_image parameters with non-image Content-Type values.
Outbound network connections originating from the PHP worker process shortly after a manage_website.php upload event.
New administrator sessions or credential changes immediately preceding suspicious upload activity.

Detection Strategies

Inspect web server access logs for POST requests to /manage_website.php followed by GET requests to newly created files under the image upload path.
Deploy file integrity monitoring on the application's image and asset directories to flag any non-image MIME types written by the web user.
Use a web application firewall to alert on multipart uploads where the declared extension does not match the file's magic bytes.

Monitoring Recommendations

Forward Apache, Nginx, and PHP-FPM logs to a centralized analytics platform and correlate upload requests with subsequent script execution events.
Monitor PHP processes for unexpected child processes such as sh, bash, nc, curl, or wget that may indicate webshell activity.
Track administrative authentication events to manage_website.php and alert on logins from unfamiliar geographies or IP ranges.

How to Mitigate CVE-2025-11470

Immediate Actions Required

Restrict network access to /manage_website.php through IP allowlisting or VPN-only administrative access until a patch is applied.
Rotate all administrator credentials for the Hotel and Lodge Management System and audit existing accounts for unauthorized additions.
Review the image upload directory for unexpected scripts and remove any non-image files written since deployment.
Disable PHP execution within asset and upload directories using web server configuration.

Patch Information

No official vendor patch is referenced in the NVD record for CVE-2025-11470 at the time of publication. Organizations running the SourceCodester Hotel and Lodge Management System 1.0 should consult the SourceCodester project page and the VulDB CTI entry #327588 for updates. Where no fix is available, consider replacing the application with a maintained alternative.

Workarounds

Add server-side validation that enforces an allowlist of image extensions (.jpg, .png, .gif) and verifies file magic bytes before writing uploads to disk.
Configure the web server to deny script handlers within the upload directory; for Apache, place a .htaccess file that sets php_flag engine off and removes script handlers.
Store uploaded assets outside the web root and serve them through a controlled handler that streams file contents rather than allowing direct execution.
Apply least-privilege filesystem permissions so the web server user cannot create executable files in publicly reachable paths.

bash

# Configuration example: deny PHP execution in the upload directory (Apache)
<Directory "/var/www/hotel/uploads">
    php_flag engine off
    RemoveHandler .php .phtml .php5
    RemoveType .php .phtml .php5
    <FilesMatch "\.(php|phtml|php5)$">
        Require all denied
    </FilesMatch>
</Directory>