CVE-2025-46191: Code Injection
Arbitrary File Upload in userpaymentupdate.php in SourceCodester Client Database Management System 1.0 allows unauthenticated users to upload arbitrary files via the uploadedfilecancelled field. Due to the absence of proper file extension checks, MIME type validation, and authentication, attackers can upload executable PHP files to a web-accessible directory (/files/). This allows them to execute arbitrary commands remotely by accessing the uploaded script, resulting in full Remote Code Execution (RCE) without authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46191?
CVE-2025-46191 is classified as a high-severity vulnerability due to its potential to allow unauthenticated remote code execution.
How do I fix CVE-2025-46191?
To fix CVE-2025-46191, implement strict validation for file uploads, including checks for file extensions and MIME types, and enforce user authentication for file upload functionalities.
What are the potential impacts of exploiting CVE-2025-46191?
Exploiting CVE-2025-46191 can lead to arbitrary file uploads, which may result in unauthorized access or compromise of the server and sensitive data.
Who is affected by CVE-2025-46191?
CVE-2025-46191 affects users of SourceCodester Client Database Management System version 1.0 that allow file uploads without adequate security measures.
Can CVE-2025-46191 be exploited remotely?
Yes, CVE-2025-46191 can be exploited remotely, as it allows unauthenticated users to upload files without proper restrictions.