PT-2025-23087 · Sourcecodester · Sourcecodester Web-Based Pharmacy Product Management System

Litsasuk · Published 2025-05-28 · Updated 2025-06-02 · CVE-2025-45997

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sourcecodester Web-based Pharmacy Product Management System version 1.0 Sourcecodester Web-based Pharmacy Product Management System version 0.0.1

Description The issue allows an attacker to upload a PHP file disguised as an image by modifying the Content-Type header to image/jpg. This can be exploited by changing the header to mimic an image file, allowing the upload of malicious PHP code.

Recommendations For version 1.0, update the file upload validation to check the actual file type rather than relying on the Content-Type header. For version 0.0.1, implement a secure file upload mechanism that verifies the file type and prevents the upload of executable code, such as PHP files. As a temporary workaround, consider disabling the file upload feature until a secure update is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-45997

Affected Products

Sourcecodester Web-Based Pharmacy Product Management System

References · 7

• 🔥 https://github.com/litsasuk/CVE-POC/blob/main/CVE-2025-45997.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-45997 · Security Note
• https://osv.dev/vulnerability/CVE-2025-45997 · Vendor Advisory
• https://twitter.com/cracbot/status/1929493248705233185 · Twitter Post
• https://twitter.com/cybercronai/status/1927946819603939725 · Twitter Post
• https://twitter.com/CVEnew/status/1927730785869828408 · Twitter Post
• https://sourcecodester.com/php/17883/web-based-product-alert-system.html · Note