CVE-2025-3729: High OS Command Injection in Pharmacy System

CVE-2025-3729 is a high severity OS command injection flaw (CVSS 7.3) in SourceCodester Web-based Pharmacy Product Management System 1.0. It affects the database backup handler in backup.php and needs no login. The record lists no fixed version, so check the project page, restrict access, and stop passing request input to a shell.

What's affected

The record names SourceCodester Web-based Pharmacy Product Management System version 1.0. The affected file is backup.php in the Database Backup Handler component, and the argument the record points to is txtdbname. The record lists no fixed version.

The record lists the weakness as CWE-77 (improper neutralization of special elements used in a command) and CWE-78 (OS command injection). The CVSS 3.1 score is 7.3 (high), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The vector shows the flaw can be reached over the network, and no login is needed. Confidentiality impact is rated low, integrity low and availability low.

The record says the exploit has been disclosed to the public and may be used. It does not say the flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Treat any copy that is reachable from the internet as the priority.

How to check if you're exposed

This is a PHP application distributed as source code, so there is usually no package manager entry to query. Check your own deployment.

1. Find out whether you run it. Search your web roots for the affected file:

find /var/www -type f -name 'backup.php' 2>/dev/null

2. Confirm the version from the project files or install notes and compare it with version 1.0.
3. Look at how the txtdbname value is used. Request input that reaches a shell call is the pattern the record describes:

grep -n 'exec(\|system(\|shell_exec(\|passthru(\|popen(' backup.php 2>/dev/null

4. Review web server logs for requests to backup.php, and review the host for unexpected processes or files created by the web server account.

If you manage many repositories, the free in-browser dependency scan covers the libraries your projects pull in, and the Gold directory lets you look up other CVEs by product. Neither replaces reviewing the code of an application you deploy by hand.

What to do now

1. Restrict who can reach the application, and block access to backup.php from anyone but your administrators.
2. Check the project page for a newer release. The record lists no fixed version, so the advisory should be checked before you plan an upgrade.
3. Stop building shell commands from request input. Use the database driver's own export features, or pass a fixed command with a validated name.
4. Run the web server account with the fewest permissions possible, with no write access outside its own directories.
5. Treat the host as suspect if the backup page was ever exposed. Review it for files and processes you do not recognize.
6. Remove the backup feature from the public site if you only need it for maintenance.

Why it matters

Command injection happens when an application builds a command line from user input and hands it to the operating system. The shell then reads parts of the input as commands. A database backup page is a typical place for it, because the tool that does the work is an external program and the database name is supplied by the user.

The weakness classes the record lists, CWE-77 and CWE-78, cover this pattern. The risk is larger than for most web flaws because the commands run as the web server account on the host, not just inside the database. Public disclosure shortens the time before others try it, so exposed copies should be handled first.

Quick check

Sources

• Gold entry for CVE-2025-3729
• NVD record for CVE-2025-3729, published 2025-04-16, as summarized above
• Reference listed in the record
• Reference listed in the record
• Reference listed in the record
• Reference listed in the record

Last reviewed: 18 October 2026.