A weakness has been identified in code-projects Online Bidding System 1.0. This issue affects the function categoryadd of the file /administrator/addcategory.php. This manipulation of the argument catimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
References
| Link | Resource |
|---|---|
| https://code-projects.org/ | Product |
| https://github.com/Yohane-Mashiro/cve/blob/main/upload%201.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.333338 | Permissions Required VDB Entry |
| https://vuldb.com/?id.333338 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.698717 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.698718 | Third Party Advisory VDB Entry |
Configurations
History
02 Dec 2025, 03:20
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Fabian online Bidding System
Fabian |
|
| CPE | cpe:2.3:a:fabian:online_bidding_system:1.0:*:*:*:*:*:*:* | |
| References | () https://code-projects.org/ - Product | |
| References | () https://github.com/Yohane-Mashiro/cve/blob/main/upload%201.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.333338 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.333338 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.698717 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.698718 - Third Party Advisory, VDB Entry |
24 Nov 2025, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-24 00:15
Updated : 2025-12-02 03:20
NVD link : CVE-2025-13574
Mitre link : CVE-2025-13574
CVE.ORG link : CVE-2025-13574
JSON object : View
Products Affected
fabian
- online_bidding_system