CVE-2025-13573: Advanced Library Management System RCE Flaw

CVE-2025-13573 Overview

CVE-2025-13573 is an unrestricted file upload vulnerability in Projectworlds Advanced Library Management System 1.0. The flaw resides in /add_book.php, where the image parameter accepts attacker-controlled files without proper validation [CWE-434, CWE-284]. An authenticated remote attacker can submit malicious payloads through this parameter to upload arbitrary files to the web server.

The issue affects the book management workflow of the application. Public disclosure references indicate the exploit has been released, increasing the risk of opportunistic abuse against exposed installations.

Critical Impact
Authenticated attackers can upload arbitrary files via the image argument in /add_book.php, potentially staging web shells or other malicious content on affected installations.

Affected Products

Projectworlds Advanced Library Management System 1.0
CPE: cpe:2.3:a:projectworlds:advanced_library_management_system:1.0
Component: add_book.php (image upload handler)

Discovery Timeline

2025-11-24 - CVE-2025-13573 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13573

Vulnerability Analysis

The vulnerability exists in the add_book.php endpoint of Projectworlds Advanced Library Management System 1.0. The endpoint accepts an image parameter intended for book cover artwork. The application fails to enforce restrictions on uploaded file types, content, or extensions before persisting the file on the server.

This weakness maps to [CWE-434] Unrestricted Upload of File with Dangerous Type and [CWE-284] Improper Access Control. An attacker holding low-privilege credentials can submit server-executable content such as PHP scripts in place of legitimate image data. Once written to a web-accessible directory, the uploaded file can be requested directly to trigger execution within the web server context.

The attack does not require user interaction and is exploitable over the network. According to VulDB references, exploit details have been published, lowering the barrier for reproduction.

Root Cause

The root cause is missing server-side validation of file uploads in the add_book.php handler. The code accepts the image field without verifying MIME type, magic bytes, file extension, or file size. There is also no enforced rename, sandboxed storage path, or execution restriction on the destination directory.

Attack Vector

An attacker authenticates with any valid low-privilege account, navigates to the book creation flow, and submits a multipart form POST to /add_book.php. The image field carries a payload such as a PHP web shell with a doctored extension or content type. After upload, the attacker requests the stored file URL to execute commands on the underlying server within the privileges of the web service account.

No verified exploit code is referenced. See the GitHub Report Documentation and VulDB #333337 for additional technical context.

Detection Methods for CVE-2025-13573

Indicators of Compromise

Unexpected .php, .phtml, .phar, or double-extension files appearing in upload directories used by the Library Management System.
Web server access logs showing POST requests to /add_book.php followed by GET requests to newly created files in image storage paths.
Outbound network connections originating from the web server process to attacker-controlled infrastructure shortly after an upload event.

Detection Strategies

Inspect upload directories for files whose MIME type, magic bytes, or extension differ from declared image formats.
Correlate authentication events for low-privilege accounts with subsequent add_book.php POST activity from the same session.
Apply web application firewall rules that block multipart uploads to /add_book.php where the file content is not a valid image.

Monitoring Recommendations

Enable detailed access logging on the PHP application server, capturing request body size and uploaded filenames.
Alert on execution of interpreter processes such as php-cgi or php-fpm spawning shell processes like sh, bash, or cmd.exe.
Monitor file integrity on web root directories and flag new executable script files written outside normal deployment workflows.

How to Mitigate CVE-2025-13573

Immediate Actions Required

Restrict network access to the Projectworlds Advanced Library Management System until a fix is applied, especially for internet-exposed instances.
Disable PHP execution in directories that store uploaded images, using web server configuration controls.
Audit existing upload directories for unauthorized files and remove any non-image content immediately.

Patch Information

No vendor advisory or official patch is listed in the available references for Projectworlds Advanced Library Management System 1.0. Track the VulDB CTI ID #333337 entry and the vendor project page for fix availability. Until a patch is released, treat affected instances as vulnerable and apply compensating controls.

Workarounds

Implement a reverse-proxy or WAF rule that validates the magic bytes of uploads to /add_book.php and rejects non-image content.
Reconfigure the web server so the upload directory is served as static content only, with PHP handlers disabled via directives such as php_flag engine off or equivalent Nginx location blocks.
Enforce strong authentication and remove unused low-privilege accounts that could be leveraged to reach the vulnerable endpoint.

bash

# Apache configuration example to disable PHP execution in the uploads directory
<Directory "/var/www/library/uploads">
    php_flag engine off
    AddType text/plain .php .phtml .phar
    Options -ExecCGI
</Directory>