CVE-2025-2973 is a medium severity (CVSS 6.3) unrestricted file upload in code-projects College Management System 1.0. The profile_image argument in /Admin/student.php is not checked properly. I could not confirm a fixed version, so limit access to the admin area and verify upload handling.
What's affected
The record lists code-projects College Management System 1.0 as affected. The file is /Admin/student.php and the argument is profile_image.
The record does not name a fixed version, and the code-projects.org site is a general project index rather than a vendor advisory. The other reference is a researcher's write up on GitHub, which I did not use for details. Assume there is no official patch and plan accordingly.
The record says the exploit was disclosed publicly and the attack can start remotely. It does not say the flaw is exploited in the wild, and it is not in the CISA KEV catalog.
How to check if you're exposed
This type of project is usually a PHP application you host yourself, so the check is local.
- Confirm whether the application is deployed and whether it is version 1.0.
- Review where profile images are stored, and list files there with extensions other than common image types.
- Check web server logs for POST requests to /Admin/student.php from addresses you do not recognize.
Because the endpoint is in an Admin folder, also confirm whether it requires a login, and whether that folder is reachable from the internet.
What to do now
- Identify all deployments of this College Management System and take any public facing copy offline or behind a VPN if it does not need to be open.
- Restrict the /Admin path by network address or add authentication at the web server.
- Change the upload code or server config so that only image types you expect are accepted and nothing in the upload folder can run as a script.
- Check the upload folder for unexpected files and keep copies if you find any.
- Plan a move to a maintained application if no vendor fix appears.
Why it matters
The record maps the flaw to CWE-434 (Unrestricted Upload of File with Dangerous Type) and CWE-284 (Improper Access Control). The profile image field is meant for pictures, but the application does not enforce that strongly enough.
Student information systems hold personal data about minors and staff, which raises the stakes. A web server that runs an uploaded script would give a remote user control at the web server's privilege level, and that could expose the database credentials in the application's configuration.
Free sample code projects are popular for learning, and some end up in production. If that is your case, treat the code as unmaintained and review it before exposing it to the internet.
Quick check
Why is a login area still a concern?
Access to the admin area can come from weak or reused passwords, and the record does not say whether login is required. Limit network access as well.
Is there a fixed version?
The record does not give one. Check the project's own page and your source for updates, and do not assume a fix exists.
Sources
Last reviewed: 19 October 2026.
