CVE-2025-11417
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0 affecting /admin/voters_add.php. Manipulation of the photo argument leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
An attacker could upload arbitrary files to the server, potentially leading to remote code execution and full system compromise. Voting systems are especially sensitive to result manipulation.
Recommendation
Immediately restrict access to the admin panel, validate uploaded file types, and consider updating or retiring the vulnerable version of the system.
Other vulnerabilities in Campcodes Advanced Online Voting Management System
See all- CVE-2025-11410Medium
A flaw has been found in Campcodes Advanced Online Voting Management System 1.0 affecting /admin/voters_add.php. Manipulation of the firstname argument leads to SQL injection. The attack can be executed remotely and the exploit is public; other parameters might also be affected.
- CVE-2025-11409Medium
A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0 affecting /index.php. Manipulation of the voter argument results in SQL injection. Remote exploitation is possible and the exploit is now public.
Original NVD description (English source)
A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This vulnerability affects unknown code of the file /admin/voters_add.php. Executing manipulation of the argument photo can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS