PT-2025-23081 · Sourcecodester · Sourcecodester Client Database Management System

Xingsumingxun · Published 2025-05-28 · Updated 2025-06-02 · CVE-2025-5299

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SourceCodester Client Database Management System version 1.0

Description A critical vulnerability was found in the SourceCodester Client Database Management System. The issue affects the file /user order customer update.php, where the manipulation of the uploaded file cancelled argument leads to unrestricted upload. This can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For SourceCodester Client Database Management System version 1.0, as a temporary workaround, consider disabling the file /user order customer update.php or restricting access to it until a patch is available. Avoid using the uploaded file cancelled argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-5299

Affected Products

Sourcecodester Client Database Management System

References · 12

• 🔥 https://github.com/RS7325/cve/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2025-5299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5299 · Security Note
• https://twitter.com/cracbot/status/1929493247165931669 · Twitter Post
• https://vuldb.com/?submit.585732 · Note
• https://t.me/cvetracker/24817 · Telegram Post
• https://twitter.com/CVEnew/status/1927713965200593071 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1927706547125158389 · Twitter Post
• https://vuldb.com/?ctiid.310426 · Note
• https://t.me/cvenotify/123820 · Telegram Post
• https://sourcecodester.com · Note
• https://vuldb.com/?id.310426 · Note