CVE-2025-56295
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A file upload vulnerability exists in Computer Laboratory System 1.0. Staff can upload PHP backdoor files when modifying personal avatar information and use web shell tools to gain server access.
Risk Assessment
An attacker can take over the server, steal data, or install additional malware, compromising the confidentiality and integrity of the system.
Recommendation
Immediately restrict the upload of executable files (e.g., PHP) in user profiles and implement file type validation and antivirus scanning.
Other vulnerabilities in Computer Laboratory System
See all- CVE-2025-60307Critical
A SQL injection vulnerability has been discovered in code-projects Computer Laboratory System 1.0. Entering a universal password in the Password field on the login page can bypass authentication.
- CVE-2025-14642Medium
In the Computer Laboratory System 1.0 from code-projects, a vulnerability was found in the file technical_staff_pic.php, where manipulation of the argument image leads to unrestricted upload. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2025-14641Medium
In the Computer Laboratory System 1.0 from code-projects, a vulnerability was found in the file admin/admin_pic.php, where manipulation of the argument image causes unrestricted upload. The attack may be initiated remotely, and the exploit has been published.
Original NVD description (English source)
code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Staff can upload malicious files by uploading PHP backdoor files when modifying personal avatar information and use web shell connection tools to obtain server permissions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS