CVE-2025-7412 Details

A critical vulnerability allowing unrestricted file uploads has been identified in Code-Projects Library System version 1.0. The issue resides in the file '/user/student/profile.php', where the 'image' parameter can be manipulated to bypass file type and content validation. This vulnerability can be exploited remotely, enabling attackers to upload malicious PHP scripts, such as web shells, which can then be used to gain full control over the affected system.

Users are advised to implement stricter file upload validations, such as whitelisting allowed file types and verifying file contents. Additionally, uploaded files should be stored in non-executable directories and monitored for suspicious activity.