CVE-2025-4923 Details

A critical file upload vulnerability has been identified in SourceCodester Client Database Management System version 1.0. The issue resides in the file '/user_delivery_update.php', where insufficient validation of the 'uploaded_file_cancelled' parameter allows for unrestricted file uploads. This vulnerability can be exploited remotely, enabling attackers to upload malicious PHP scripts that could be executed on the server.

It is recommended to implement file type validation by checking both the MIME type and file extension against an allowlist of permitted types. Additionally, file size should be restricted to prevent denial-of-service attacks via large uploads. Uploaded files should be renamed to avoid using user-supplied names, and script execution should be disabled in the upload directory.