Paper/Archive/CVE-2025-3783

CVE-2025-3783

SourceCodester Web-based Pharmacy Product Management System — SourceCodester Web-based Pharmacy Product Management System add-product.php unrestricted upload

EPSS 1.0%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 62.3.623 × 2012.5 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /add-product.php. The manipulation of the argument Avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource

Web-based Pharmacy Product Management System1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.305605 refvuldb.com/?ctiid.305605 writeupvuldb.com/?submit.553723 exploitgithub.com/yaklang/IRifyScanResult/blob/main/Web-based%20Pharmacy%20Product%20Management%20System/upload_in_add-product.md refsourcecodester.com