CVE-2025-7412: Library System Unrestricted Upload RCE Flaw

CVE-2025-7412 Overview

CVE-2025-7412 is an unrestricted file upload vulnerability in code-projects Library System 1.0. The flaw resides in the /user/student/profile.php script, where the image parameter accepts attacker-controlled input without proper validation. An authenticated remote attacker can manipulate the upload to place arbitrary files on the web server. The issue is classified under CWE-284: Improper Access Control. Public disclosure of the exploit details means defenders should treat the application as exposed wherever it remains internet-facing.

Critical Impact
Authenticated attackers can upload arbitrary files via the image parameter in profile.php, potentially enabling webshell deployment and compromise of the underlying Library System application.

Affected Products

code-projects Library System 1.0
Deployments referenced by CPE cpe:2.3:a:code-projects:library_system:1.0
Web environments hosting the vulnerable /user/student/profile.php endpoint

Discovery Timeline

2025-07-10 - CVE-2025-7412 published to the National Vulnerability Database (NVD)
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-7412

Vulnerability Analysis

The Library System 1.0 application exposes a student profile page that allows users to upload an image associated with their account. The handler in /user/student/profile.php processes the image parameter without enforcing file type, extension, or content checks. Because the upload path is reachable over the network and requires only low-privilege authentication, attackers with a student-level account can submit malicious files instead of legitimate images.

The vulnerability is tracked under CWE-284 Improper Access Control. The EPSS probability is 0.311% with a percentile of 22.5, indicating limited observed exploitation activity. Public discussion is referenced in the GitHub CVE Discussion and VulDB entry #315872.

Root Cause

The root cause is missing validation on the image upload parameter inside profile.php. The application does not restrict MIME types, extensions, or magic bytes, and it stores the uploaded file in a location reachable via HTTP. As a result, server-executable files such as PHP scripts can be written into a web-accessible directory.

Attack Vector

The attack is network-based and requires the attacker to authenticate as a student user. The attacker submits a crafted multipart upload to /user/student/profile.php with a script payload supplied through the image field. If the file is stored under the web root with an executable extension, requesting it directly triggers code execution in the context of the web server.

No verified proof-of-concept code is published in trusted repositories. Refer to the VulDB CTI record #315872 for additional technical context.

Detection Methods for CVE-2025-7412

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar inside the directory used to store student profile images.
POST requests to /user/student/profile.php containing multipart payloads with non-image MIME types or suspicious file extensions.
New or modified files in the uploads directory whose timestamps correlate with student login activity.
Outbound network connections originating from the web server process shortly after a profile upload.

Detection Strategies

Inspect web server access logs for POST requests to profile.php followed by GET requests targeting newly created files in the same upload path.
Apply web application firewall rules that block multipart uploads where the declared content type does not match common image MIME types.
File integrity monitoring on the uploads directory to flag any non-image file types being written.

Monitoring Recommendations

Enable verbose logging on the PHP runtime and forward web server logs to a centralized analytics platform for review.
Alert on web server processes spawning shells, interpreters, or outbound network connections.
Track authentication anomalies on student accounts that precede file upload activity, such as logins from unfamiliar IP ranges.

How to Mitigate CVE-2025-7412

Immediate Actions Required

Restrict access to /user/student/profile.php at the reverse proxy or WAF until a validated patch is applied.
Audit the uploads directory and remove any files that are not legitimate user-submitted images.
Rotate credentials for any student or administrator accounts that may have been used to stage uploads.
Disable PHP execution in directories that store user-uploaded content.

Patch Information

No official vendor patch is referenced in the NVD entry or in the code-projects resource page at the time of publication. Administrators should monitor the VulDB submission record and the GitHub CVE Discussion for fix availability.

Workarounds

Add server-side validation that enforces an allowlist of image MIME types and verifies file content using magic-byte inspection.
Rename uploaded files to randomized identifiers and strip user-controlled extensions before writing to disk.
Store uploaded files outside the web root and serve them through a controlled handler that sets a non-executable content type.
Configure the web server to refuse script execution in upload directories, for example using an .htaccess directive or equivalent Nginx location block.

bash

# Apache example: block script execution in the uploads directory
<Directory "/var/www/library_system/user/student/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|phar|pl|py|cgi|sh)$">
        Require all denied
    </FilesMatch>
</Directory>