CVE-2025-11656 Details
Description
A weakness has been identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This affects an unknown function of the file /assets/editNotes.php. Executing manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
A vulnerability allowing unauthenticated arbitrary file uploads has been identified in the ProjectsAndPrograms School Management System, specifically in versions prior to the commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The issue resides in the 'editNotes.php' file, where the 'file' parameter can be manipulated to upload malicious PHP scripts. This vulnerability can be exploited remotely, with the uploaded scripts executed on the server with the same privileges as the web server user.
It is recommended to implement access controls to restrict the '/assets/editNotes.php' endpoint to authenticated users only. Additionally, uploaded files should be validated to allow only safe file types, checked using MIME type verification, and renamed to prevent direct execution. Finally, uploaded files should be stored outside the web root or the web server should be configured to deny execution in the upload directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/qqy-123/cve/issues/1 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://github.com/qqy-123/cve/issues/1 | [email protected] | ExploitIssue TrackingThird Party Advisory |
| https://vuldb.com/?ctiid.328073 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.328073 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.665603 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| oranbyte school management system | 1.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Oct 16, 2025 | Initial Analysis | [email protected] |
| Oct 14, 2025 | CVE Modified | CISA-ADP |
| Oct 13, 2025 | New CVE Received | [email protected] |