CVE-2025-13564: Pre-school Management System DOS Flaw

CVE-2025-13564 Overview

CVE-2025-13564 is an arbitrary file deletion vulnerability in SourceCodester Pre-School Management System 1.0. The flaw resides in the removefile function of app/controllers/FilehelperController.php. An authenticated remote attacker can manipulate the filepath argument to delete files on the server, leading to denial of service. The weakness is classified as [CWE-404] (Improper Resource Shutdown or Release). A public exploit has been released, increasing the likelihood of opportunistic attacks against exposed deployments.

Critical Impact
Remote authenticated attackers can delete arbitrary application files, disrupting service availability and potentially rendering the management system inoperable.

Affected Products

Kimz190 Pre-School Management System 1.0
app/controllers/FilehelperController.php (removefile function)
Deployments hosted via SourceCodester distributions

Discovery Timeline

2025-11-23 - CVE-2025-13564 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13564

Vulnerability Analysis

The vulnerability exists in the file management logic of the Pre-School Management System. The removefile function in FilehelperController.php accepts a filepath parameter from the client without sufficient validation or sanitization. The controller passes this value directly to file-removal logic, allowing an attacker to specify paths outside the intended directory scope.

Because the parameter is attacker-controlled and the application does not constrain the target to a safe directory, files critical to application operation can be removed. Deleting configuration files, database artifacts, or PHP source files produces denial of service conditions. The flaw requires low-privilege authentication but no user interaction.

Root Cause

The root cause is improper resource lifecycle management [CWE-404]. The removefile handler treats the filepath argument as trusted input and does not enforce path normalization, allow-list validation, or scope restrictions before invoking file deletion routines.

Attack Vector

The attack vector is network-based. An authenticated user submits a crafted HTTP request to the removefile endpoint with a filepath value pointing to an application or system file. The server then removes the targeted file. Exploit details have been published to a public GitHub repository, lowering the barrier to weaponization.

No verified exploit code is reproduced here. Technical references are available in the GitHub PoC Repository and VulDB Analysis #333328.

Detection Methods for CVE-2025-13564

Indicators of Compromise

HTTP requests to endpoints invoking FilehelperController::removefile with filepath values containing directory traversal sequences such as ../ or absolute paths.
Unexpected disappearance of PHP source files, configuration files, or uploaded assets under the application root.
Web server errors referencing missing includes from app/controllers/ or related directories.

Detection Strategies

Inspect web server access logs for POST or GET requests to the removefile route containing suspicious filepath parameters.
Monitor file integrity on the application directory and flag unauthorized deletions of .php, .ini, or database files.
Correlate authenticated user sessions with file deletion events to identify anomalous user behavior.

Monitoring Recommendations

Enable verbose application logging for all calls to the file helper controller, capturing user identity and parameters.
Deploy file integrity monitoring on app/controllers/ and uploads/ directories with alerting on deletions.
Forward web and application logs to a centralized SIEM for query-based hunting against the removefile endpoint.

How to Mitigate CVE-2025-13564

Immediate Actions Required

Restrict network access to the Pre-School Management System until a fix is applied, limiting reach to trusted users only.
Audit application files and restore any missing components from a known-good backup.
Disable or remove the removefile route if it is not required for normal operation.

Patch Information

No vendor advisory or official patch has been published at the time of NVD release. Operators should monitor SourceCodester Security Resources and VulDB #333328 for updates. Until a vendor patch is available, apply source-level fixes that validate the filepath argument against an allow-list and constrain deletion operations to a sandboxed directory using realpath() checks.

Workarounds

Add server-side validation in FilehelperController.php that rejects any filepath containing .., absolute paths, or non-allow-listed extensions.
Enforce role-based authorization on the removefile endpoint to restrict use to administrative accounts only.
Run the PHP process under a user account with minimal filesystem permissions, preventing deletion of files outside the upload directory.

bash

# Example web server rule to block traversal payloads on the removefile route
location ~ /FilehelperController/removefile {
    if ($arg_filepath ~* "(\.\./|^/|%2e%2e)") {
        return 403;
    }
}