CVE-2025-7175: Fabian E-commerce Site RCE Vulnerability

CVE-2025-7175 Overview

CVE-2025-7175 is an unrestricted file upload vulnerability in code-projects E-Commerce Site 1.0. The flaw resides in the /admin/users_photo.php script, where the photo parameter accepts attacker-controlled file content without enforcing type or extension validation. An authenticated remote attacker with low privileges can upload arbitrary files to the application directory. The issue is tracked under CWE-284: Improper Access Control and has been publicly disclosed with technical details available in third-party advisories.

Critical Impact
Authenticated attackers can upload arbitrary files through the users_photo.php endpoint, enabling potential web shell deployment and persistent access to the E-Commerce Site application.

Affected Products

code-projects E-Commerce Site 1.0
Deployments exposing /admin/users_photo.php
Web servers hosting the vulnerable PHP application

Discovery Timeline

2025-07-08 - CVE-2025-7175 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7175

Vulnerability Analysis

The vulnerability stems from improper access control on the file upload handler in /admin/users_photo.php. The endpoint accepts the photo argument and writes the supplied content to disk without validating the file type, MIME type, or extension. Attackers can substitute server-executable content for the expected image data. The exploit has been publicly disclosed and may be reused by opportunistic actors targeting installations of this PHP application.

Root Cause

The root cause is missing input validation and missing access control on the upload routine, classified as [CWE-284]. The users_photo.php handler trusts client-supplied file metadata and does not enforce an allowlist of permitted extensions or content types. The PHP application also fails to relocate or rename uploaded artifacts outside of the web-accessible directory.

Attack Vector

The attack vector is network-based and requires low privileges. An authenticated user submits a crafted multipart request to /admin/users_photo.php with the photo parameter containing PHP or other executable content. Once uploaded, the attacker requests the resulting file directly through the web server to trigger execution. No user interaction is required to complete the upload step. Technical reproduction notes are documented in the public GitHub CVE writeup and VulDB entry #315114.

Detection Methods for CVE-2025-7175

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) in upload directories used by the E-Commerce Site application
HTTP POST requests to /admin/users_photo.php from non-administrative IP addresses or unusual user-agents
Outbound connections originating from the web server process shortly after upload activity

Detection Strategies

Inspect web server access logs for POST requests targeting /admin/users_photo.php with non-image Content-Type or oversized payloads
Run integrity checks against the application upload directory and alert on the creation of files with script extensions
Correlate authentication events with upload requests to flag low-privilege accounts performing administrative file operations

Monitoring Recommendations

Enable web application firewall rules that block uploads containing PHP tags or script content regardless of declared MIME type
Forward web server, file system, and process telemetry into a centralized analytics platform for correlation across upload, write, and execution events
Monitor for php-cgi or php-fpm process spawns referencing files within user-writable upload paths

How to Mitigate CVE-2025-7175

Immediate Actions Required

Restrict access to /admin/ paths using network ACLs, IP allowlists, or reverse-proxy authentication until a fix is applied
Disable PHP execution in any directory used to store user-uploaded media via web server configuration
Audit existing upload directories for unauthorized files and remove any artifacts that do not match expected image formats

Patch Information

No vendor patch has been published for code-projects E-Commerce Site 1.0 at the time of this writing. Operators should consult the code-projects portal and the VulDB advisory for updates. Until an official fix is released, code-level changes to enforce extension allowlists, validate MIME types server-side, and store uploads outside the web root are required.

Workarounds

Add server-side validation that rejects any photo upload whose extension is not in an explicit image allowlist such as .jpg, .png, or .gif
Rename uploaded files to randomized identifiers and serve them through a handler that sets a static Content-Type header
Configure the web server to deny script execution in the upload directory, for example with an Apache php_admin_flag engine off directive or an equivalent Nginx location block

bash

# Apache configuration example to disable PHP execution in upload directories
<Directory "/var/www/ecommerce/admin/uploads">
    php_admin_flag engine off
    AddType text/plain .php .phtml .phar
    Options -ExecCGI
</Directory>