CVE-2025-13200: Farm Management System Info Disclosure

CVE-2025-13200 Overview

CVE-2025-13200 is an information disclosure vulnerability affecting Janobe Farm Management System version 1.0, distributed through SourceCodester. The flaw exposes directory contents through improper server configuration, classified under [CWE-548] (Exposure of Information Through Directory Listing). Remote attackers can enumerate application files and directory structures without authentication. The exploit has been publicly disclosed, increasing the likelihood of opportunistic scanning. While the vulnerability does not directly compromise data integrity or availability, exposed file listings can reveal application structure, configuration files, and sensitive artifacts useful for follow-on attacks.

Critical Impact
Remote, unauthenticated attackers can enumerate directory contents on affected Farm Management System 1.0 deployments, exposing file structures that aid reconnaissance and secondary exploitation.

Affected Products

Janobe Farm Management System 1.0
SourceCodester-distributed Farm Management System deployments
CPE: cpe:2.3:a:janobe:farm_management_system:1.0

Discovery Timeline

2025-11-15 - CVE-2025-13200 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13200

Vulnerability Analysis

The vulnerability stems from improper web server configuration that permits directory listing on the Janobe Farm Management System 1.0. When a client requests a directory path without a default index file, the server returns an HTML listing of all files and subdirectories. This behavior is categorized under [CWE-548] and provides attackers with visibility into the application's internal structure. Attackers do not need credentials or user interaction to trigger the exposure. The disclosed content may include backup files, source code fragments, upload directories, or configuration remnants left in web-accessible paths.

Root Cause

The root cause is a missing or misconfigured directory index directive in the web server serving the Farm Management System. The application ships without hardened defaults that disable automatic directory indexing. Directories lacking an index.php or index.html file return a browsable listing instead of an HTTP 403 response.

Attack Vector

An attacker sends HTTP GET requests to known or guessable directory paths of the deployed application. The server responds with rendered directory contents, allowing enumeration of file names, timestamps, and sizes. Common targets include /uploads/, /includes/, /admin/, and backup directories. See the GitHub CVE Issue Discussion and VulDB entry #332498 for further technical detail.

Detection Methods for CVE-2025-13200

Indicators of Compromise

Repeated HTTP GET requests to directory paths without trailing filenames from a single source IP.
Web server responses containing the Index of / HTML header string returned to external clients.
Scanner user-agents such as dirb, gobuster, feroxbuster, or ffuf in access logs.
Sequential enumeration of predictable directories like /uploads/, /backup/, /config/.

Detection Strategies

Inspect web server access logs for 200 OK responses to bare directory requests where an index file is absent.
Deploy web application firewall rules that identify and alert on Index of / response bodies.
Run authenticated vulnerability scans against the application to flag any directory returning listing content.

Monitoring Recommendations

Forward web server access and error logs to a centralized SIEM or data lake for correlation across IPs and paths.
Alert on burst traffic patterns targeting multiple directory paths within short time windows.
Baseline normal directory request patterns and flag statistical anomalies in path diversity.

How to Mitigate CVE-2025-13200

Immediate Actions Required

Disable automatic directory indexing at the web server level for all virtual hosts serving the application.
Audit web root directories and remove any backup files, archives, or unused artifacts.
Place a valid index.php or index.html file in every directory that must remain web-accessible.
Restrict access to sensitive directories such as /includes/, /config/, and /uploads/ using server ACLs.

Patch Information

No vendor patch has been published for Janobe Farm Management System 1.0 as of the last NVD update. Administrators should apply web server hardening as a compensating control. Monitor the SourceCodester project page and VulDB entry #332498 for updates.

Workarounds

On Apache, remove Options Indexes or explicitly set Options -Indexes in the site configuration or .htaccess file.
On Nginx, ensure the autoindex off; directive is set at the server or location block level.
Relocate non-public files outside the document root where feasible.
Deploy a web application firewall rule to block responses containing the Index of / string.

bash

# Configuration example
# Apache: disable directory listing in httpd.conf or .htaccess
<Directory "/var/www/farm_management_system">
    Options -Indexes +FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

# Nginx: disable autoindex in server block
server {
    location / {
        autoindex off;
    }
}