PT-2025-34745 · Sourcecodester · Sourcecodester Human Resource Information System

M00N_L33 · Published 2025-08-26 · Updated 2025-08-31 · CVE-2025-9476

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Information System version 1.0

Description: A vulnerability exists in SourceCodester Human Resource Information System 1.0, specifically within an unknown functionality of the /Superadmin Dashboard/process/editemployee process.php file. Manipulation of the employee file201 argument allows for unrestricted file uploads. This issue can be exploited remotely. The exploit has been publicly disclosed and may be in use.

Recommendations: As a mitigation, restrict access to the /Superadmin Dashboard/process/editemployee process.php file. Avoid using the employee file201 argument in the affected file until a fix is available.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-9476

Affected Products

Sourcecodester Human Resource Information System

References · 13

• 🔥 https://github.com/lrjbsyh/CVE_Hunter/issues/5 · Exploit
• 🔥 https://github.com/lrjbsyh/CVE_Hunter/issues/5#issue-3322736605 · Exploit
• https://osv.dev/vulnerability/CVE-2025-9476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9476 · Security Note
• https://t.me/CVEtracker/30904 · Telegram Post
• https://twitter.com/CVEnew/status/1960275290367668548 · Twitter Post
• https://vuldb.com/?ctiid.321345 · Note
• https://twitter.com/VulmonFeeds/status/1960291852466188303 · Twitter Post
• https://sourcecodester.com · Note
• https://vuldb.com/?submit.634757 · Note
• https://twitter.com/cracbot/status/1962108162838073469 · Twitter Post
• https://t.me/cveNotify/133418 · Telegram Post
• https://vuldb.com/?id.321345 · Note