CVE-2025-4898: Student Result Management System Path Traversal

CVE-2025-4898 Overview

CVE-2025-4898 is a path traversal vulnerability in SourceCodester Student Result Management System 1.0. The flaw resides in the unlink function within update_system.php, part of the Logo File Handler component. Attackers can manipulate the old_logo parameter to traverse directories and delete arbitrary files on the server. The attack is initiated remotely and requires low-privilege authentication. The exploit has been publicly disclosed, increasing exposure for unpatched deployments.

Critical Impact
Authenticated remote attackers can delete arbitrary files on the hosting server, potentially disrupting application availability and integrity by removing configuration, logs, or source files.

Affected Products

Munyweki Student Result Management System 1.0
SourceCodester-distributed builds of Student Result Management System
Deployments exposing update_system.php to networked users

Discovery Timeline

2025-05-18 - CVE-2025-4898 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4898

Vulnerability Analysis

The vulnerability is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory. The affected code path handles logo replacement operations within the administrative panel of the Student Result Management System. When a user updates the application logo, the handler invokes PHP's unlink function against a filename supplied through the old_logo request parameter.

The application does not canonicalize or validate the submitted path before passing it to unlink. Attackers can submit traversal sequences such as ../ to escape the intended logo directory and target arbitrary files accessible to the web server process. Successful exploitation leads to file deletion, which can impact application integrity and availability.

Root Cause

The root cause is missing input validation on the old_logo parameter inside update_system.php. The handler trusts client-supplied filenames and performs destructive filesystem operations without enforcing a directory allowlist, verifying file extensions, or resolving the real path against a restricted base.

Attack Vector

Exploitation requires network access to the application and a low-privilege authenticated session. The attacker submits a crafted request to update_system.php with an old_logo value containing traversal sequences that resolve to a sensitive file. The web server deletes the target file using the privileges of the PHP process.

No verified public proof-of-concept code is included here. Technical details are documented in the Notion Analysis on SRMS Vulnerability and the VulDB entry 309454.

Detection Methods for CVE-2025-4898

Indicators of Compromise

HTTP POST requests to update_system.php containing old_logo parameter values with ../ or encoded traversal sequences such as %2e%2e%2f.
Unexpected deletion of files outside the application's logo upload directory, particularly configuration, log, or PHP source files.
Web server access logs showing authenticated low-privilege users invoking logo update functionality at abnormal frequency.

Detection Strategies

Deploy web application firewall rules that inspect the old_logo parameter for directory traversal patterns and reject requests containing path separators.
Monitor filesystem audit logs on directories hosting the application for unlink or delete operations originating from the PHP service account.
Correlate authenticated session identifiers with logo update requests to identify abuse of low-privilege accounts.

Monitoring Recommendations

Enable PHP open_basedir restrictions and log violations to detect out-of-scope filesystem access attempts.
Forward web server and application logs to a centralized analytics platform for query against traversal signatures.
Alert on sudden absence of critical application files such as config.php, .htaccess, or installation markers.

How to Mitigate CVE-2025-4898

Immediate Actions Required

Restrict network access to the administrative interface of Student Result Management System until a patched build is deployed.
Audit all accounts with permission to invoke update_system.php and disable unused low-privilege accounts.
Back up application files and database content so that deleted assets can be restored following exploitation.

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Review the VulDB record and SourceCodester Security Resources for future updates. Organizations maintaining their own forks should modify update_system.php to validate old_logo against an allowlist and resolve the real path within the designated upload directory before calling unlink.

Workarounds

Apply a web application firewall rule to block requests whose old_logo parameter contains .., /, \, or URL-encoded equivalents.
Set filesystem permissions so the PHP process cannot delete files outside the intended uploads directory.
Configure PHP open_basedir to constrain the application to its own document root and upload paths.

bash

# Example php.ini hardening for the affected virtual host
open_basedir = "/var/www/srms/:/tmp/"
disable_functions = "exec,system,passthru"