CVE-2025-3764: Pharmacy Management System RCE Vulnerability

CVE-2025-3764 Overview

CVE-2025-3764 is an unrestricted file upload vulnerability in SourceCodester Web-based Pharmacy Product Management System 1.0. The flaw resides in /edit-product.php, where the Avatar parameter accepts arbitrary file uploads without proper validation. Authenticated attackers can exploit this issue remotely over the network with low privileges. The vulnerability maps to [CWE-434] Unrestricted Upload of File with Dangerous Type and [CWE-284] Improper Access Control. Public disclosure of the exploit details increases the risk of opportunistic attacks against exposed installations.

Critical Impact
Attackers can upload arbitrary files through the product edit functionality, potentially leading to webshell deployment and remote code execution on the host server.

Affected Products

SourceCodester Web-based Pharmacy Product Management System 1.0
Vendor: senior-walter
Affected component: /edit-product.php (Avatar upload handler)

Discovery Timeline

2025-04-17 - CVE-2025-3764 published to NVD
2025-05-14 - Last updated in NVD database

Technical Details for CVE-2025-3764

Vulnerability Analysis

The vulnerability affects the product editing workflow in the Web-based Pharmacy Product Management System. When a user submits the edit product form, the application processes the Avatar file upload parameter without enforcing restrictions on file type, extension, or content. An attacker authenticated as a low-privileged user can substitute a server-side script, such as a PHP webshell, for the expected image file. Once uploaded to a web-accessible directory, the file can be requested over HTTP to execute attacker-controlled code.

The attack requires network access and low-level authentication, but no user interaction. According to the EPSS model, the probability of exploitation in the next 30 days is 0.263% (49.979 percentile).

Root Cause

The root cause is the absence of file validation logic in the Avatar upload handler within /edit-product.php. The application does not verify MIME type, file extension allowlists, or magic bytes before writing the uploaded file to disk. This [CWE-434] weakness is compounded by improper access control [CWE-284], which fails to restrict who can invoke the upload endpoint and where uploaded files are written.

Attack Vector

An attacker authenticates to the application, navigates to the edit-product functionality, and submits a multipart form request to /edit-product.php with a malicious file supplied as the Avatar field. The server stores the file in an uploads directory accessible via the web server. The attacker then requests the uploaded script directly to trigger code execution under the web server account.

For technical reproduction details, refer to the GitHub Product Management Documentation and the VulDB entry #305398.

Detection Methods for CVE-2025-3764

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) inside the application's uploads or avatar directories.
HTTP POST requests to /edit-product.php containing multipart Avatar payloads with non-image content types.
Outbound connections originating from the web server process to unknown external hosts shortly after upload activity.
Web server logs showing GET requests to recently created files in the uploads path returning HTTP 200.

Detection Strategies

Inspect web access logs for sequential POST /edit-product.php and GET /uploads/<file>.php patterns from the same client IP.
Apply file integrity monitoring to the application's upload directory and alert on creation of script files.
Deploy web application firewall rules that block uploads where extension or magic bytes do not match a permitted image type.

Monitoring Recommendations

Forward web server, PHP error, and authentication logs to a centralized analytics platform for correlation.
Track process creation events spawned by the web server user, particularly shell or interpreter executions following upload events.
Monitor for new files written to web-accessible directories outside of normal deployment changes.

How to Mitigate CVE-2025-3764

Immediate Actions Required

Restrict access to /edit-product.php to trusted administrative users only through network segmentation or authentication controls.
Disable script execution in the uploads directory by reconfiguring the web server.
Audit existing uploaded files for unauthorized scripts and remove any suspicious content.
Review application access logs for prior exploitation attempts targeting the Avatar parameter.

Patch Information

No official vendor patch is currently listed for the Web-based Pharmacy Product Management System 1.0. Organizations using this application should monitor SourceCodester for updates and consider replacing the affected component until a fix is available.

Workarounds

Implement server-side validation that enforces an allowlist of image MIME types and verifies file magic bytes before saving.
Rename uploaded files to randomized identifiers and store them outside the web root, serving them through a controlled handler.
Configure Apache or Nginx to deny execution of .php files within the uploads directory using <Directory> or location directives.
Place the application behind a web application firewall with rules that block executable content in multipart uploads.

bash

# Apache configuration example: disable PHP execution in uploads directory
<Directory "/var/www/pharmacy/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>