CVE-2025-0341 is a medium severity unrestricted file upload flaw (CVSS 6.3) in CampCodes Computer Laboratory Management System version 1.0, reached through the e_photo handling in /class/edit/edit. The record lists no patched release, so the fix is to correct the code, restrict access to the app, or retire it.
What's affected
The record names CampCodes Computer Laboratory Management System, version 1.0. The weak spot is the e_photo parameter handled at /class/edit/edit. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which means the issue is reachable over the network, needs low privileges (an ordinary account), and has low impact on each of confidentiality, integrity and availability, for a base score of 6.3.
There is no fixed version in the record, and none of the references name one. Treat every copy of this version as affected until you have checked with the project yourself.
The record also says the exploit has been disclosed to the public. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list. Public technical detail still lowers the effort needed, so do not wait on that distinction.
How to check if you're exposed
Start with whether you run the product at all. Search your servers and repositories for the file named in the record.
find /var/www -type f -name "edit"
Then read the file and check how the uploaded name and type are validated before the file is saved.
grep -n "_FILES\|move_uploaded_file" /path/to/edit
Next, look for files in the upload folder that should not be there. Script files such as .php next to image files are a red flag.
find /var/www -path "*upload*" -type f \( -name "*.php" -o -name "*.phtml" \)
If you cannot find the product, run a free scan of your repositories and manifests at gold.safeguard.sh/scan. It reports known CVEs for the dependencies it can see. Keep in mind that a hand-written PHP project may not show up in a package inventory, so a file search on the server is the more reliable check here.
What to do now
- Find every copy of CampCodes Computer Laboratory Management System you run, including test and demo servers, and note which ones face the internet.
- Take internet-facing copies offline or place them behind a VPN, a login proxy or an IP allow list until the code is fixed.
- Accept only an allow list of image types, check the content as well as the name, and rename every saved file to a random name with a fixed safe extension.
- Store uploads outside the web root, or switch off script execution in the upload folder at the web server level.
- Review the upload folder for unexpected script files, and if you find one, treat the server as compromised and rotate its credentials.
- Watch the project and the NVD record for a fix, and if the product is a sample or abandoned project, plan to replace it. Check the advisory pages before you rely on any claim of a patch.
- Rescan after changes and add the app to a recurring check so a regression is caught.
Why it matters
Upload handlers fail when they trust what the client says about a file. The record maps this to CWE-434 and to access control, CWE-284. If the server will store and later run a script the attacker supplied, the result can be code running on your server.
The reference for this CVE is titled as a remote code execution through file upload.
The safe design is simple. Decide what you accept, verify it, rename it, and store it where the server will not run it.
Quick check
Is checking the file extension enough?
No. Check the content type and the file contents as well, rename the file, and keep the upload folder from running scripts.
Is there a patched version of Computer Laboratory Management System?
The record does not name one. Check the project page and the advisory, and fix the handler yourself if you must keep running it.
Sources
The other references in the record are public write-ups of the flaw. They were not fetched or reproduced here, and this post gives no attack steps.
Last reviewed: 19 October 2026.
