PT-2025-37447 · Unknown · 1000Projects Online Project Report Submission/Evaluation System

Ustc-L1Nk · Published 2025-09-15 · Updated 2025-09-18 · CVE-2025-10424

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1000projects Online Student Project Report Submission and Evaluation System version 1.0

Description A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/faculty controller.php. Manipulation of the argument new image causes unrestricted upload, and the attack is possible to be carried out remotely. The exploit has been publicly disclosed.

Recommendations Restrict access to the file /admin/controller/faculty controller.php to prevent unauthorized uploads. As a temporary workaround, consider restricting the use of the new image argument in the affected function until a patch is available.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-10424

Affected Products

1000Projects Online Project Report Submission/Evaluation System

References · 13

• 🔥 https://github.com/lan041221/cvec/issues/22 · Exploit
• https://osv.dev/vulnerability/CVE-2025-10424 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10424 · Security Note
• https://twitter.com/RedPacketSec/status/1967675482826023314 · Twitter Post
• https://vuldb.com/?submit.647173 · Note
• https://t.me/CVEtracker/32479 · Telegram Post
• https://twitter.com/CVEnew/status/1967437754284831146 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1967451140678734069 · Twitter Post
• https://t.me/cveNotify/135432 · Telegram Post
• https://t.me/cveNotify/135858 · Telegram Post
• https://vuldb.com/?submit.647176 · Note
• https://vuldb.com/?ctiid.323858 · Note
• https://vuldb.com/?id.323858 · Note