PT-2025-6888 · Unknown · Needyamin Library Card System
Maloy Roy Orko
+1
·
Published
2025-02-16
·
Updated
2025-02-25
·
CVE-2025-1355
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
needyamin Library Card System version 1.0
Description:
A critical vulnerability was found in the needyamin Library Card System, affecting an unknown functionality of the file /signup.php of the component Add Picture. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Recommendations:
For needyamin Library Card System version 1.0, as a temporary workaround, consider disabling the file /signup.php of the component Add Picture until a patch is available. Restrict access to the Add Picture component to minimize the risk of exploitation. Avoid using the /signup.php file in the affected system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Access Control
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Needyamin Library Card System