A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.php. This manipulation of the argument catimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
References
| Link | Resource |
|---|---|
| https://code-projects.org/ | Product |
| https://github.com/Yohane-Mashiro/cve/blob/main/upload%201.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.333338 | Permissions Required VDB Entry |
| https://vuldb.com/?id.333338 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.698717 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.698718 | Third Party Advisory VDB Entry |
Configurations
History
02 Dec 2025, 03:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://code-projects.org/ - Product | |
| References | () https://github.com/Yohane-Mashiro/cve/blob/main/upload%201.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.333338 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.333338 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.698717 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.698718 - Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:a:fabian:online_bidding_system:1.0:*:*:*:*:*:*:* | |
| First Time |
Fabian
Fabian online Bidding System |
24 Nov 2025, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-24 00:15
Updated : 2025-12-02 03:20
NVD link : CVE-2025-13574
Mitre link : CVE-2025-13574
CVE.ORG link : CVE-2025-13574
JSON object : View
Products Affected
fabian
- online_bidding_system