CVE-2025-4468 is a high severity unrestricted file upload in SourceCodester Online Student Clearance System 1.0, in /edit-photo.php through the userImage argument. The record says the exploit has been disclosed publicly and gives no fix. Do not run this sample application on a public server; patch the code or remove it.
What's affected
- Product: SourceCodester Online Student Clearance System, a small PHP sample application.
- Affected: version 1.0.
- Fixed version: none is stated in the record, and the vendor reference is a project listing rather than an advisory. Treat every copy of this code as vulnerable.
- Location:
/edit-photo.php, through theuserImageargument. - Public exploit: the record says the exploit has been disclosed to the public and may be used.
- Severity: CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), rated High.
How to check if you're exposed
Applications like this are often downloaded as a zip, installed on a test server and then forgotten there. Look for it.
# find the vulnerable file on your web servers
find /var/www /srv /opt -name "edit-photo.php" 2>/dev/null
# check web logs for requests to it
grep -h "edit-photo.php" /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null | head
If the file exists on a server that faces the internet, assume it has been probed, since the exploit details are public. Also check student, training and demo servers, which tend to run exactly this kind of code.
To see which of your projects pull in an affected component, run the free in-browser dependency scan at gold.safeguard.sh/scan. Reachability analysis then helps you separate libraries that your code actually calls from ones that only sit in a lockfile.
What to do now
- Remove the application from any public host. If you must keep it, put it behind a login at the web server.
- Disable script execution in the upload directory, and store uploaded files outside the web root.
- Review the upload folder for files that are not images, such as scripts, and delete anything you did not put there.
- If a script was uploaded, treat the server as compromised: rotate database and application credentials and review the host.
- Fix the code by checking the file type on the server, renaming files on save and enforcing a size limit.
Why it matters
The weakness is CWE-434, unrestricted upload of a file of a dangerous type, with CWE-284, improper access control, noted in the record. The photo upload page accepts the file named in userImage without proving that it is an image. On a PHP server, a script that lands in a web visible folder can be requested and run, which turns an upload form into a way to run code.
Apps like this are written for teaching, and they skip checks that a production system needs. That is fine on a laptop and a problem on a public address. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list, though the record does say a public exploit exists.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
The record gives no fixed version. Treat the code as unpatched and fix or remove it.
Why does this matter for a small sample app?
Copies of such code end up on real servers, and the exploit details are public, so scanners can find them.
Sources
Last reviewed: 18 October 2026.
