CVE-2025-15199

Executive Summary

CVE-2025-15199 is an unrestricted file upload vulnerability in code-projects College Notes Uploading System 1.0, reachable through the /dashboard/userprofile.php endpoint via manipulation of the image argument. An authenticated remote attacker (CVSS PR:L) can upload files of arbitrary type, potentially leading to web shell deployment and remote code execution depending on server configuration. No vendor patch currently exists, and public exploit details have been disclosed, elevating operational risk for any internet-exposed deployment.

Technical Analysis

The vulnerability resides in the file /dashboard/userprofile.php, where the image parameter — evidently intended for profile picture uploads — is processed without adequate validation of the uploaded file's type, extension, or content. The NVD description confirms the flaw class as an "unrestricted upload" (CWE-284, Improper Access Control). Function-level detail is not disclosed; the description states only that an "unknown function" within userprofile.php is impacted.

Mechanically, unrestricted file upload arises when an application accepts a client-supplied file and stores it in a web-accessible location without enforcing an allowlist of safe extensions/MIME types, without verifying magic bytes, and without renaming the stored artifact. When those controls are absent, an attacker can supply a server-executable payload (e.g., a script matching the web server's handler mapping) that the server will later interpret and execute on request. The image argument name explicitly signals multipart/form-data file handling, meaning the attack surface is the profile-update workflow of an authenticated dashboard route.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (score 6.3, MEDIUM) tells us several important things about the attack surface: it is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), and it requires low privileges — consistent with the dashboard route requiring a logged-in user session (PR:L). No user interaction is needed (UI:N), and the impact is scoped to the vulnerable component (S:U) with low-level confidentiality, integrity, and availability effects. The "low" integrity impact is notable: it suggests that while arbitrary files can be written, the CVSS authoring did not assume guaranteed code execution — plausibly because execution depends on web server configuration (e.g., whether uploaded paths are handler-mapped) rather than the application alone.

The EPSS score is 0.00282, placing this CVE in roughly the 18.9th percentile of exploited vulnerabilities — low current exploitation probability, though EPSS is a forward-looking estimate and public PoC disclosure frequently precedes opportunistic scanning. The CVE is not listed in CISA KEV, and no Nuclei template or exploit code repository entry has been confirmed in the provided data. Critically, patch confidence is 0/4 — every tracked source reports no vendor fix, no patched version, and no advisory — meaning the vulnerable code path remains exposed indefinitely in default deployments.

Exploitation Scenarios

No public PoC code is available in this dataset; the following chain is inferred from the vulnerability class and the disclosed attack surface. Any step beyond what the NVD description states is explicitly labeled as inference.

1. Reconnaissance / target identification. An attacker scans for internet-facing instances of code-projects College Notes Uploading System 1.0, typically by fingerprinting the login or dashboard pages. Shodan or similar services can be used with page-content or title dorks targeting the product name. Because the exploit requires a valid account, the attacker first identifies a target that permits self-registration or that exposes default/reused credentials — access control on account creation is not described in the CVE data and must be assessed per deployment.

2. Authentication and access to the vulnerable route. Using low-privileged credentials (any student or user account), the attacker navigates to the authenticated dashboard and locates the profile update functionality. The vulnerable endpoint is /dashboard/userprofile.php, and the multipart submission includes the image field.

3. Triggering the unrestricted upload. The attacker submits a multipart/form-data request to userprofile.php in which the image argument carries a file whose extension/content is not on any enforced allowlist. Because the application performs no effective type validation (the disclosed root cause), the server accepts and stores the file. At the vulnerability-class level: unrestricted upload means that any extension the server is capable of processing — including server-side scripting formats — can be delivered; if the server maps the storage location to a script handler, requesting the stored file executes the payload.

4. Post-exploitation impact. With a stored executable payload, an attacker can achieve web-shell-level code execution under the web server's process identity, enabling file system reconnaissance, credential harvesting from configuration files, pivoting into the internal network, and establishing persistence. Even in the absence of code execution (e.g., a hardened server that refuses to interpret uploads), stored arbitrary files enable phishing content hosting, defacement, malware staging, and client-side attacks against other users viewing attacker-controlled content. The CVSS subscores (C:L/I:L/A:L) bound the direct single-exploit impact as low, but the practical blast radius is limited chiefly by server configuration, not by the application.

Impact Assessment

Business impact centers on integrity of the hosting application and, conditionally, compromise of the underlying web server host. Affected systems are any deployment of code-projects College Notes Uploading System 1.0 exposed to untrusted users — particularly educational institutions running the software on internet-facing infrastructure. The PR:L requirement reduces unauthenticated mass-exploitation risk but does not eliminate it where open registration exists: an attacker can self-provision the needed account. The AV:N/AC:L combination means exploitation requires no special network position and no complex preconditions beyond a session.

Blast radius: because the application is a PHP-based content system serving student notes, a successful upload-to-execution chain places the web root, application configuration, database credentials, and any co-tenant data on the same host at risk. Stored malicious files can affect every user who later views the compromised profile or served artifact, adding a client-side dimension. Availability impact (A:L) reflects potential service disruption during post-exploitation activity rather than a direct denial-of-service property of the flaw itself.

The absence of a vendor patch (0/4 confidence) and the absence of CISA KEV listing frame the medium score in a less comfortable light than the number alone suggests: the vulnerability is disclosed and publicly described, exploitation prerequisites are low, and no remediation is currently available from the vendor.

Detection Guidance

Sigma Rule

title: Unrestricted File Upload via College Notes Uploading System userprofile.php
id: 9f2c7b41-3d8e-4a56-b1f2-7c0d5e9a8b34
status: experimental
description: Detects POST requests to /dashboard/userprofile.php submitting an image parameter, indicating potential exploitation of CVE-2025-15199 (unrestricted upload).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-15199
author: valtersit.com
date: 2025-01-01
tags:
  - attack.t1190
  - attack.initial_access
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|endswith: '/dashboard/userprofile.php'
  selection_arg:
    cs-uri-query|contains: 'image'
  condition: selection_endpoint
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate profile image updates by users
level: medium

YARA Rule

rule CVE_2025_15199_Uploaded_Webshell_Indicator
{
    meta:
        description = "Detects uploaded files containing common webshell indicators unassociated with legitimate profile images, for triage of artifacts written via College Notes Uploading System userprofile.php (CVE-2025-15199)."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15199"
        date = "2025-01-01"
        severity = "medium"

    strings:
        $php_open  = "<?php" ascii nocase
        $php_eval  = "eval(" ascii nocase
        $php_sys   = "system(" ascii nocase
        $php_exec  = "exec(" ascii nocase
        $php_shell = "shell_exec" ascii nocase
        $php_upload = "$_FILES" ascii nocase
        $php_base64 = "base64_decode" ascii nocase

    condition:
        filesize < 2MB and
        $php_open and
        2 of ($php_*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-15199 Possible Unrestricted File Upload to College Notes Uploading System userprofile.php"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/dashboard/userprofile.php"; http.uri; content:"image"; http.request_body; content:"Content-Disposition"; nocase; http.request_body; content:"filename="; nocase; pcre:"/filename=\"[^\"]+\.(php|phtml|php[0-9]|phar|jsp|asp|aspx|cgi|pl)\"/i"; classtype:web-application-attack; reference:cve,2025-15199; sid:202515199; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=10m
  [ network where network.protocol == "http" and http.request.method == "POST" and
    url.path == "/dashboard/userprofile.php" ]
  [ file where event.action == "creation" and file.extension in
    ("php", "phtml", "phar", "jsp", "asp", "aspx", "cgi", "pl") ]

Splunk SPL Query

index=web sourcetype=access_combined
  cs_method=POST uri_path="/dashboard/userprofile.php"
| eval suspicious=if(match(uri_query, "(?i)image") AND match(request_body, "(?i)filename=\"[^\"]+\.(php|phtml|phar|jsp|asp|aspx|cgi|pl)\""), 1, 0)
| where suspicious=1
| stats count values(uri_query) as args values(http_user_agent) as ua by src_ip clientip status
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2025-15199">
  <rule id="1001991" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/dashboard/userprofile.php</field>
    <regex type="pcre2">(?i)favicon|image</regex>
    <description>CVE-2025-15199: Potential unrestricted file upload attempt to College Notes Uploading System userprofile.php</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2025_15199,file_upload,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Because no vendor fix exists, compensating controls are mandatory.

1. Immediate mitigations (hours-to-days):

   • Restrict network exposure of the College Notes Uploading System dashboard to trusted networks/VPN; do not leave /dashboard/ reachable from the internet.
   • At the web server layer, deny execution in the upload/storage directory (e.g., for Apache, disable script handlers in the upload path; for Nginx, ensure uploaded locations are served as static content only).
   • Enforce a strict upload allowlist at the reverse proxy / WAF for the image parameter (jpeg/png/webp only) and reject requests with executable extensions in Content-Disposition filenames.
   • Tighten account provisioning to prevent unauthenticated self-registration on internet-facing instances.

2. Patch / upgrade steps: No patched version is available. Monitor the code-projects project page and CVE/NVD records for an updated release. When a fix is published, upgrade immediately and re-validate that upload validation enforces extension, MIME-type, and magic-byte checks.

3. Long-term hardening: Conduct code review of /dashboard/userprofile.php to enforce allowlisted extensions, randomized stored filenames, storage outside the web root (or served via a non-executing handler), and content-type verification. Adopt a vulnerability management process for third-party/small-vendor software without vendor security programs; isolate the application in a segmented environment; monitor the file-integrity baselines of web-accessible directories to detect newly written executable artifacts.

References

• NVD — CVE-2025-15199: https://nvd.nist.gov/vuln/detail/CVE-2025-15199
• CWE-284 (Improper Access Control): https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (CVE-2025-15199): https://api.first.org/data/v1/epss?cve=CVE-2025-15199
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• code-projects College Notes Uploading System project page (vendor source; no advisory issued): https://code-projects.org/