CVE-2025-70151: Scholars Tracking System RCE Vulnerability

CVE-2025-70151 Overview

CVE-2025-70151 is an unrestricted file upload vulnerability in code-projects Scholars Tracking System 1.0 that allows authenticated attackers to achieve remote code execution. The vulnerable endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied filename without validating the file type or extension. By uploading a PHP file and then requesting it from the /uploads/ directory, an attacker can execute arbitrary PHP code as the web server user.

Critical Impact

Authenticated attackers can execute arbitrary code on the server by uploading malicious PHP files, potentially leading to full system compromise, data theft, or lateral movement within the network.

Affected Products

• code-projects Scholars Tracking System 1.0
• PHP web applications using vulnerable file upload implementations
• Systems with web-accessible upload directories without proper access controls

Discovery Timeline

• 2026-02-18 - CVE CVE-2025-70151 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-70151

Vulnerability Analysis

This vulnerability stems from a failure to implement proper file upload validation controls (CWE-434: Unrestricted Upload of File with Dangerous Type). The Scholars Tracking System accepts file uploads through profile picture functionality but fails to validate the content type, file extension, or actual file contents before storing the uploaded file in a publicly accessible directory.

The attack is network-accessible and requires low privileges (authenticated user account). Once exploited, the attacker gains complete control over the web server process, enabling them to read sensitive files, modify application data, establish persistent backdoors, or pivot to other systems on the network.

Root Cause

The root cause is the absence of security controls in the file upload handling logic. The application trusts user-supplied filenames and stores uploaded files directly in the uploads/ directory without:

1. Validating the file extension against an allowlist (e.g., .jpg, .png, .gif)
2. Checking the MIME type or magic bytes of the uploaded content
3. Renaming files to prevent execution of malicious scripts
4. Storing uploads outside the web root or blocking script execution in the upload directory

Attack Vector

The attack vector is network-based and exploits the file upload functionality. An authenticated attacker can upload a file with a .php extension containing malicious PHP code through either the update_profile_picture.php or upload_picture.php endpoint. Since the application preserves the original filename and stores the file in the web-accessible uploads/ directory, the attacker can then directly request the uploaded file (e.g., /uploads/malicious.php) to execute the embedded PHP code with the privileges of the web server user.

The exploitation flow involves: (1) authenticating to the application with valid credentials, (2) uploading a PHP webshell disguised as or named as a profile picture, (3) navigating to the uploaded file URL to trigger code execution. For detailed technical analysis, refer to the GitHub CVE-2025-70151 Analysis.

Detection Methods for CVE-2025-70151

Indicators of Compromise

• Presence of .php, .phtml, .php5, or other executable extensions in the uploads/ directory
• Web server access logs showing requests to /uploads/*.php files
• Unusual outbound connections or command execution from the web server process
• New or modified files in the uploads directory with recent timestamps that don't match legitimate user activity

Detection Strategies

• Monitor file system events for creation of executable files (.php, .phtml, etc.) in upload directories
• Implement web application firewall (WAF) rules to detect PHP code patterns in file upload requests
• Review web server access logs for HTTP requests to script files within upload directories
• Deploy file integrity monitoring on the uploads/ directory to alert on unexpected file additions

Monitoring Recommendations

• Configure alerting for any new files with executable extensions created in web-accessible directories
• Implement log correlation between file upload events and subsequent web requests to uploaded files
• Monitor web server processes for unusual child process spawning or network connections
• Establish baseline behavior for upload directory activity and alert on anomalies

How to Mitigate CVE-2025-70151

Immediate Actions Required

• Remove or restrict access to the vulnerable update_profile_picture.php and upload_picture.php endpoints
• Audit the uploads/ directory for any existing malicious files and remove them
• Configure the web server to deny script execution in the uploads/ directory
• Implement network segmentation to limit the impact of potential compromise

Patch Information

No official patch is currently available from code-projects. Organizations using the Scholars Tracking System 1.0 should implement the workarounds below and consider discontinuing use of the affected functionality until a security update is released. For more information about the project, see the Code Projects Overview.

Workarounds

• Add server configuration to disable PHP execution in the uploads/ directory using .htaccess or web server configuration
• Implement application-level file validation that checks both file extension and MIME type against an allowlist
• Rename uploaded files to random strings with safe extensions to prevent direct execution
• Move the upload directory outside the web root and serve files through a download script
• Implement additional authentication and authorization controls on the file upload functionality

# Apache configuration to disable PHP execution in uploads directory
# Add to .htaccess in the uploads/ directory or to Apache configuration

<Directory /var/www/html/uploads>
    # Disable PHP execution
    php_admin_flag engine Off
    
    # Alternatively, use this for Apache 2.4+
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
    
    # Remove handler for PHP files
    RemoveHandler .php .phtml .php3 .php4 .php5 .phps
    RemoveType .php .phtml .php3 .php4 .php5 .phps
</Directory>