CVE-2025-3765: Pharmacy Management System RCE Vulnerability

CVE-2025-3765 Overview

CVE-2025-3765 is an unrestricted file upload vulnerability in SourceCodester Web-based Pharmacy Product Management System 1.0. The flaw resides in /edit-photo.php, where the Avatar parameter accepts arbitrary file uploads without proper validation. Authenticated remote attackers can abuse this weakness to upload malicious files to the web server. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed instances. The vulnerability is tracked under [CWE-284] (Improper Access Control) and [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Remote attackers with low-privilege access can upload arbitrary files via /edit-photo.php, potentially leading to webshell deployment and server compromise.

Affected Products

Senior-walter Web-based Pharmacy Product Management System 1.0
Component: /edit-photo.php
Parameter: Avatar

Discovery Timeline

2025-04-17 - CVE-2025-3765 published to NVD
2025-05-14 - Last updated in NVD database

Technical Details for CVE-2025-3765

Vulnerability Analysis

The vulnerability exists in the avatar upload handler implemented in /edit-photo.php. The script accepts file uploads through the Avatar form parameter without enforcing restrictions on file type, extension, or MIME content. An authenticated user with low privileges can submit a multipart form request containing an executable script such as a PHP file. The application stores the uploaded file inside a web-accessible directory, allowing the attacker to invoke it through a direct HTTP request.

The weakness combines two related root causes tracked under [CWE-284] and [CWE-434]. Access control on the upload endpoint is improper, and content validation is absent. As a result, attackers can place webshells on the server and execute arbitrary commands within the web server process context. The EPSS probability is approximately 0.421%, indicating limited but non-negligible exploitation likelihood.

Root Cause

The /edit-photo.php handler does not validate uploaded file extensions against an allowlist of safe image formats. It also fails to verify MIME types, inspect file magic bytes, or rename uploaded files to neutral identifiers. Files retain their original attacker-supplied names and extensions when written to disk.

Attack Vector

The attack is performed remotely over the network. An attacker authenticates to the application with any valid account, navigates to the profile photo edit function, and submits a crafted multipart upload containing PHP code with a .php extension. After upload, the attacker requests the file URL to execute server-side code. See the public technical write-up on GitHub and the VulDB advisory for additional detail.

Detection Methods for CVE-2025-3765

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) in upload or avatar directories used by the pharmacy application.
HTTP POST requests to /edit-photo.php containing non-image file content or suspicious Content-Type mismatches.
Outbound network connections from the web server process to unfamiliar external hosts following an upload event.
Web server access logs showing direct GET requests to uploaded avatar files with non-standard extensions.

Detection Strategies

Inspect web server logs for POST requests to /edit-photo.php and correlate with file creations in upload directories.
Monitor file integrity on the web root and flag new executable scripts written by the web server user.
Apply web application firewall (WAF) rules that block uploads whose declared extension does not match an image MIME signature.

Monitoring Recommendations

Enable verbose logging on the PHP upload handler and forward logs to a centralized analytics platform.
Alert on web server processes spawning child processes such as sh, bash, cmd.exe, or powershell.exe.
Track outbound DNS and HTTP traffic from web server hosts to identify post-exploitation callback activity.

How to Mitigate CVE-2025-3765

Immediate Actions Required

Restrict network access to the pharmacy management application until validation controls are in place.
Audit the upload directory used by /edit-photo.php and remove any non-image files.
Revoke and reissue credentials for any accounts that may have interacted with the vulnerable endpoint.
Review web server and application logs for indicators of prior exploitation.

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Organizations should monitor the SourceCodester project page and the VulDB advisory for updates. Until a fix is released, apply the workarounds below.

Workarounds

Modify /edit-photo.php to enforce an allowlist of image extensions such as .jpg, .png, and .gif, and validate file magic bytes.
Store uploaded files outside the web root or in a directory configured to disallow script execution.
Rename uploaded files to server-generated identifiers and strip user-supplied extensions.
Deploy a WAF rule that blocks multipart uploads to /edit-photo.php containing PHP tags or script content.

bash

# Apache configuration to disable PHP execution in the upload directory
<Directory "/var/www/pharmacy/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>