PT-2025-41749 · Unknown · Projectsandprograms School Management System

Qingyuan Qin + 2 · Published 2025-10-13 · Updated 2025-10-20 · CVE-2025-11660

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjectsAndPrograms School Management System versions prior to 6b6fae5426044f89c08d0dd101c7fa71f9042a59

Description A flaw exists in ProjectsAndPrograms School Management System that allows for unrestricted file upload due to insufficient input validation. The issue is related to the /assets/uploadSllyabus.php file and the File argument. This allows an attacker to upload malicious files, potentially including web shells or malware, and execute code remotely. The exploit has been publicly disclosed.

Recommendations Versions prior to 6b6fae5426044f89c08d0dd101c7fa71f9042a59 should be updated. As a temporary workaround, restrict access to the /assets/uploadSllyabus.php file.

Exploit

Fix

Improper Access Control

Unrestricted File Upload

Weakness Enumeration

CWE-284

CWE-434

Related Identifiers

CVE-2025-11660

Affected Products

Projectsandprograms School Management System

References · 14

• 🔥 https://github.com/qqy-123/cve/issues/5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11660 · Security Note
• https://osv.dev/vulnerability/CVE-2025-11660 · Vendor Advisory
• https://t.me/CVEtracker/34740 · Telegram Post
• https://vuldb.com/?ctiid.328077 · Note
• https://vuldb.com/?id.328077 · Note
• https://twitter.com/RedPacketSec/status/1977596918789214436 · Twitter Post
• https://twitter.com/CVEnew/status/1977596335634149531 · Twitter Post
• https://vuldb.com/?submit.665610 · Note
• https://t.me/cveNotify/139517 · Telegram Post
• https://t.me/cveNotify/138412 · Telegram Post
• https://twitter.com/cracbot/status/1979140391136845871 · Twitter Post
• https://twitter.com/cracbot/status/1979502774514536744 · Twitter Post
• https://twitter.com/CveTodo/status/1977593190757675338 · Twitter Post