CVE-2025-11347

Executive Summary

CVE-2025-11347 is an unrestricted file upload vulnerability in code-projects Student Crud Operation, affecting versions up to and including 3.3. The flaw resides in the move_uploaded_file function within add.php, part of the Add Student Page / Edit Student Page component, and permits a remote, unauthenticated attacker to upload arbitrary files. Successful exploitation can lead to remote code execution, data tampering, or full compromise of the hosting web server, though the CVSS v3.1 base score of 7.3 reflects limited confidentiality, integrity, and availability impact per the assigned vector.

Technical Analysis

The vulnerability is classified under CWE-284 (Improper Access Control), which in this context manifests as a lack of validation and restriction on files submitted through the student record management interface. The CNA title explicitly names the move_uploaded_file function of the file add.php within the Add Student Page / Edit Student Page component. move_uploaded_file is a PHP function that relocates an uploaded file from a temporary directory to a destination chosen by the application. When the application fails to enforce proper access control — such as verifying file type, extension, MIME type, or the authentication/authorization state of the caller — an attacker can supply a file that the server subsequently stores and may execute.

The attack surface is the HTTP file upload endpoint exposed by add.php. Because the CVSS vector indicates AV:N (network) and PR:N (no privileges required), the vulnerable endpoint is reachable without prior authentication. The AC:L (low attack complexity) and UI:N (no user interaction) metrics indicate that exploitation requires no special conditions and no victim action beyond the server receiving the request.

The component naming ("Add Student Page/Edit Student Page") indicates the upload functionality is tied to student record creation and editing, implying the endpoint accepts multipart/form-data submissions intended for student documents or images. The absence of restriction on the uploaded content is the core defect. The CVSS subscores C:L/I:L/A:L indicate the impact is scored as limited across all three pillars, consistent with an upload vector that may not guarantee code execution in every deployment (e.g., depending on server configuration regarding execution of uploaded files), but still enables file placement, potential content injection, and partial system interaction.

No patch evidence exists from any tracked source, no affected version list has been enumerated beyond "up to 3.3," and no vendor fix or workaround is documented. This is a third-party, code-projects style PHP application commonly deployed in educational or demonstration contexts, frequently with default or minimal hardening.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description and CNA title. No public exploit code reference was provided beyond confirmation that a public exploit exists ("The exploit has been made public and could be used"). No specific parameter names, form field names, or endpoint paths beyond add.php are specified in the source data, so this section remains at the vulnerability-class level.

1. Reconnaissance / Target Identification. An attacker identifies internet-exposed instances of code-projects Student Crud Operation up to version 3.3. Because the application is a known third-party PHP project, fingerprinting is achievable by requesting the application's landing pages and matching page titles, HTML structure, or known static assets. Search engines or internet-wide scanning services indexing HTTP response bodies and titles can enumerate candidate hosts.

2. Triggering the Flaw Class. The attacker locates the Add Student Page / Edit Student Page, which serves add.php. This page exposes an upload feature that invokes the PHP move_uploaded_file function. The attacker submits a multipart/form-data HTTP request to this page containing a crafted file. Because the application applies no effective restriction (no authentication requirement, no extension whitelist, no MIME enforcement) to the uploaded content, the file is accepted and moved to a server-side location via move_uploaded_file.

3. Payload / Execution Method (class-level). The attacker's payload is an arbitrary file. In an unrestricted upload scenario, the attacker typically attempts to place executable server-side content (for PHP deployments, a script file). Execution depends on whether the destination directory is web-accessible and configured to execute the uploaded file type. Where this condition holds, requesting the uploaded file through the web server results in server-side code execution. Where it does not, the attacker still achieves arbitrary file placement, which can enable stored cross-site scripting, defacement, or staging of secondary payloads. The NVD data does not confirm the destination directory or execution configuration, so the outcome is presented as conditional at the vulnerability-class level.

4. Post-Exploitation Impact. With arbitrary file placement — and, in many deployments, code execution — an attacker can establish persistence, exfiltrate the application's database contents (student records, potentially credentials and personal information), pivot to the underlying host, or alter stored records. The scored limited impact (C:L/I:L/A:L) suggests the immediate, universally guaranteed effect is file placement with constrained downstream impact, expanding to full compromise when server configuration permits execution.

No public PoC code was retrieved for review; the attack chain above is inferred from the vulnerability class and the explicitly named function, file, and component.

Impact Assessment

The CVSS v3.1 base score is 7.3 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. This places the vulnerability in the High severity band. The metrics translate to the following business impacts:

• AV:N / AC:L — Exploitable over the network with minimal complexity, requiring no specialized conditions.
• PR:N / UI:N — No authentication and no user interaction required, meaning any internet-reachable instance is a candidate target. This substantially raises the exposed population.
• S:U — Impact is scoped to the vulnerable component; the scoring does not assume automatic breakout to other security authorities, though realistic post-exploitation may breach that scope.
• C:L / I:L / A:L — Limited confidentiality, integrity, and availability impact as scored. Practically, this maps to unauthorized reading of application data (student/personal records), modification or injection of stored content, and degradation of availability.

The blast radius includes any organization or individual hosting this application, especially educational institutions, training labs, and demonstration environments where such PHP CRUD applications are common. Because the application handles student data, successful exploitation may expose personally identifiable information, triggering privacy and regulatory obligations. The EPSS score of 0.00532 (43.1st percentile) indicates a currently low probability of exploitation in the wild relative to all scored CVEs, but the existence of a public exploit and the absence of any patch elevate the operational risk for exposed instances. The vulnerability is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Unrestricted File Upload to Student CRUD add.php
id: 9f2c1c7a-1134-7cve-2025-11347
status: experimental
description: Detects HTTP POST multipart uploads targeting add.php consistent with CVE-2025-11347 unrestricted file upload
author: Threat Intelligence
date: 2025/01/01
logsource:
    category: webserver
detection:
    selection_method:
        cs-method: 'POST'
    selection_uri:
        cs-uri-stem|endswith: '/add.php'
    selection_ctype:
        cs-content-type|contains: 'multipart/form-data'
    condition: selection_method and selection_uri and selection_ctype
fields:
    - c-ip
    - cs-uri-stem
    - cs-content-type
    - cs-user-agent
falsepositives:
    - Legitimate student record submissions where upload is expected and validated
level: high

YARA Rule

rule CVE_2025_11347_StudentCRUD_Upload
{
    meta:
        description = "Detects uploaded PHP payloads associated with CVE-2025-11347 unrestricted upload in code-projects Student Crud Operation"
        cve = "CVE-2025-11347"
        author = "Threat Intelligence"
        date = "2025-01-01"
        severity = "high"
    strings:
        $php_open = "<?php"
        $php_short = "<?="
        $susp_a = "move_uploaded_file"
        $susp_b = "$_FILES"
        $susp_c = "eval("
        $susp_d = "system("
        $susp_e = "shell_exec("
        $susp_f = "passthru("
        $magic_gif = "GIF89a"
        $magic_png = { 89 50 4E 47 0D 0A 1A 0A }
    condition:
        uint16(0) == 0x3F3C or
        (
            $magic_gif or $magic_png
        ) and
        any of ($php_*) and
        any of ($susp_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2025-11347 code-projects Student CRUD Unrestricted File Upload to add.php"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"add.php"; endswith; http.header; content:"Content-Type|3a 20|multipart/form-data"; http.request_body; content:"filename="; nocase; content:".php"; nocase; reference:cve,CVE-2025-11347; classtype:web-application-attack; sid:2025113471; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "POST" and
      endsWith(network.destination.ip, "") and
      stringContains(network.http.request.uri, "add.php") ]
  [ network where stringContains(network.http.request.headers.content_type, "multipart/form-data") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uri=coalesce(uri, cs_uri_stem, url)
| eval ctype=coalesce(content_type, cs_content_type)
| where like(lower(uri), "%add.php") AND lower(method)="post" AND like(lower(ctype), "%multipart/form-data%")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as target_uris by src_ip, user_agent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2025-11347,">
  <rule id="202511300" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>add.php</match>
    <regex>POST .*add\.php</regex>
    <description>CVE-2025-11347: Unrestricted file upload attempt to Student CRUD add.php</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,file_upload,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version list has been published. The following guidance is architectural and applies until a vendor patch is available.

1. Immediate Mitigations

   • Remove internet exposure of the Student Crud Operation application where possible; restrict access to trusted networks or authenticated reverse proxies.
   • Block multipart file uploads targeting add.php at the WAF/reverse-proxy layer unless explicitly required, and restrict by allowed MIME types and file extensions (deny-list PHP, PHAR, HTACCESS, and executable extensions; prefer a strict allow-list of images only).
   • Configure the web server so upload destination directories are non-executable (disable PHP handlers) and outside the webroot where feasible.
   • Disable unneeded HTTP methods and restrict upload size limits.
   • Rotate credentials and review stored student data for tampering if compromise is suspected.

2. Patch / Upgrade Steps

   • There is currently no fixed version identified. Monitor the code-projects project repository and vendor channels for an update beyond 3.3.
   • Until a patch exists, treat the application as inherently vulnerable and apply compensating controls from the immediate mitigation list.
   • If the codebase is maintained internally, implement server-side validation: enforce file extension/MIME allow-listing, generate randomized stored filenames, validate that the caller is authenticated and authorized, and store uploads outside the webroot.

3. Long-Term Hardening

   • Adopt a secure file-upload design pattern: keep uploads outside the web root, store in object storage where possible, serve through a controlled handler, and strip/validate metadata.
   • Enforce input validation and access control at the server, not the client.
   • Deploy persistent application-layer logging and alerting on upload endpoints (see detection section).
   • Maintain an inventory of third-party/demo PHP applications and decommission or isolate those that cannot be actively patched.
   • Incorporate this CVE and the affected product into vulnerability management and external attack surface scanning.

References

• NVD Entry — CVE-2025-11347: https://nvd.nist.gov/vuln/detail/CVE-2025-11347
• CWE-284: Improper Access Control — https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (score 0.00532, 43.1st percentile) — https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2025-11347 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign attribution or confirmed exploit-in-the-wild telemetry was identified in the provided data. The NVD description confirms a public exploit exists and "could be used," but no exploitation activity is currently recorded in CISA KEV or other tracked sources supplied for this report.