Unrestricted File Upload in Online Hotel Reservation System by code-projects
CVE-2025-11352
Key Information:
- Vendor
Code-projects
- Vendor
- CVE Published:
- 7 October 2025
Badges
What is CVE-2025-11352?
A significant security flaw has been identified in code-projects' Online Hotel Reservation System version 1.0. This vulnerability resides specifically within the /admin/addexec.php file, where manipulations of the 'image' argument can lead to an unrestricted file upload. This flaw enables attackers to upload malicious files without proper verification, which can be executed remotely, compromising system security. The vulnerability has been publicly disclosed and should be addressed promptly to mitigate potential threats.
Affected Version(s)
Online Hotel Reservation System 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved