CVE-2025-14195: Employee Profile Management System RCE Flaw

CVE-2025-14195 Overview

CVE-2025-14195 is an unrestricted file upload vulnerability in code-projects Employee Profile Management System 1.0. The flaw resides in the /profiling/add_file_query.php script, where the per_file parameter accepts attacker-controlled input without validating file type or content. An authenticated remote attacker can upload arbitrary files, potentially leading to limited compromise of the application. The vulnerability is classified under [CWE-284] Improper Access Control. Public disclosure of the exploit technique has occurred, increasing the likelihood of opportunistic abuse against exposed deployments.

Critical Impact
Authenticated remote attackers can upload arbitrary files via the per_file parameter, with public exploit details already released.

Affected Products

code-projects Employee Profile Management System 1.0
Carmelogarcia Employee Profile Management System (cpe:2.3:a:carmelogarcia:employee_profile_management_system:1.0)
Deployments referencing the vulnerable /profiling/add_file_query.php endpoint

Discovery Timeline

2025-12-07 - CVE-2025-14195 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14195

Vulnerability Analysis

The vulnerability exists in the file upload handler at /profiling/add_file_query.php. The per_file parameter accepts uploaded content without enforcing extension allowlists, MIME type checks, or content inspection. This permits attackers with low-privilege credentials to submit files outside the intended scope of profile attachments. Because the endpoint is reachable over the network and requires only low-privilege authentication, exploitation can be performed remotely. Public exploit information lowers the barrier to abuse, although the EPSS probability remains modest at the time of publication.

Root Cause

The root cause is improper access control combined with missing input validation on file uploads. The application trusts the per_file argument without verifying that the uploaded file conforms to expected profile-document formats. No server-side restrictions enforce file extension, content-type, or storage location separation from web-executable paths. This aligns with [CWE-284] Improper Access Control.

Attack Vector

An attacker authenticated to the Employee Profile Management System sends a crafted multipart POST request to /profiling/add_file_query.php containing an arbitrary file in the per_file field. Because validation is absent, the file is accepted and stored on the server. Depending on storage location and web server configuration, the uploaded artifact may be retrievable or executable. No verified public proof-of-concept code is included here; technical details are referenced in the VulDB entry #334615 and the GitHub project repository.

Detection Methods for CVE-2025-14195

Indicators of Compromise

POST requests to /profiling/add_file_query.php containing per_file multipart fields with unexpected extensions such as .php, .phtml, .jsp, or .exe
New files appearing in the application's upload directories without a corresponding legitimate profile update
Subsequent GET requests to uploaded artifacts originating from external IP addresses

Detection Strategies

Inspect web server access logs for high-frequency uploads to add_file_query.php from a single session or IP
Apply web application firewall (WAF) rules that block executable content in per_file upload fields
Hash and baseline files in the upload directory, alerting on any new file with a server-executable extension

Monitoring Recommendations

Forward PHP application logs and web server access logs to a centralized log platform for correlation
Monitor process creation on the web host for child processes spawned by the PHP interpreter from upload directories
Track authentication events for the Employee Profile Management System and correlate with file upload activity

How to Mitigate CVE-2025-14195

Immediate Actions Required

Restrict network access to the Employee Profile Management System to trusted internal users until a fix is applied
Disable or remove the /profiling/add_file_query.php endpoint if the file upload feature is not in use
Audit existing upload directories for unauthorized files and remove any artifacts that cannot be tied to a legitimate user action

Patch Information

At the time of NVD publication, no vendor patch has been linked in the advisory. Administrators should monitor the code-projects resource page and the GitHub project repository for updates. Refer to VulDB CTI #334615 for ongoing tracking.

Workarounds

Enforce server-side allowlist validation for file extensions and MIME types on the per_file parameter
Store uploaded files outside the web root or in a location where script execution is disabled
Add a WAF signature that rejects requests to add_file_query.php carrying executable payloads
Require strong authentication and rate-limit upload operations per session to limit abuse

bash

# Example Apache configuration to block script execution in upload directory
<Directory "/var/www/html/profiling/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .php3 .php4 .php5 .phar
    Options -ExecCGI
</Directory>