PT-2025-35651 · Unknown · Scriptandtools Real Estate Management System

Maloyroyorko · Published 2025-09-03 · Updated 2025-09-03 · CVE-2025-9847

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ScriptAndTools Real Estate Management System version 1.0

Description A weakness has been identified in an unknown function of the register.php file, allowing for unrestricted file upload through manipulation of the uimage argument. Remote exploitation is possible, and the exploit has been made publicly available.

Recommendations As a temporary workaround, consider restricting access to the register.php file to minimize the risk of exploitation. Avoid uploading any files through the uimage parameter until a fix is available.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-9847

Affected Products

Scriptandtools Real Estate Management System

References · 8

• 🔥 https://websecurityinsights.my.id/2025/08/real-estate-management-system-v-10.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9847 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9847 · Vendor Advisory
• https://vuldb.com/?id.322196 · Note
• https://t.me/CVEtracker/31547 · Telegram Post
• https://vuldb.com/?submit.641970 · Note
• https://vuldb.com/?ctiid.322196 · Note
• https://twitter.com/CVEnew/status/1963064982834221132 · Twitter Post