CVE-2025-7413 Details

A critical vulnerability allowing unrestricted file uploads has been identified in Code-Projects Library System version 1.0. This issue resides in the file '/user/teacher/profile.php', where the 'image' parameter can be manipulated to bypass file type and content validations. The vulnerability can be exploited remotely, enabling attackers to upload malicious PHP scripts, such as web shells. Once the web shell is uploaded, attackers can gain full control over the system, execute commands, navigate the file system, and access sensitive data.

It is recommended to implement proper file upload validations, such as whitelisting allowed file types and verifying MIME types. Additionally, uploaded files should be stored in non-web-accessible directories and with execution permissions disabled. Monitoring for anomalous upload patterns and logging suspicious activities can also help mitigate the risk.