CVE-2025-7547 is a high severity (CVSS 7.3) unrestricted file upload in Campcodes Online Movie Theater Seat Reservation System 1.0. The save_movie function in /admin/admin_class.php accepts a cover file without enough restriction. The record lists no fixed version, so tighten upload handling in the code or take the app offline.
The description says the exploit has been disclosed to the public and may be used. The record does not mark this CVE as exploited in the wild, and it is not a CISA Known Exploited Vulnerability.
What's affected
The record lists Campcodes Online Movie Theater Seat Reservation System 1.0. The weak spot is the save_movie function in /admin/admin_class.php, through the cover argument. That is the field where an administrator attaches a movie poster or cover image when adding a title.
I found no fixed version. The record lists none, and the vendor sells and distributes sample projects, not supported products with security advisories. The public report I read is titled as a file upload vulnerability in /admin/admin_class.php and is the only technical source I could reach. If you run this application, assume it is unpatched.
Severity needs a note. The description calls the issue critical, which is VulDB's wording. The score in the record is CVSS 7.3, High, with a vector of network access, low complexity, no privileges and no user interaction. That vector says no login is needed even though the file sits under the admin path, so do not rely on the path alone for protection. This post uses the score.
How to check if you're exposed
Search for the file and the product on your servers:
find / -name "admin_class.php" 2>/dev/null
grep -rIl "save_movie" /var/www 2>/dev/null
Open the function and read how the uploaded file is handled. Warning signs are a file name taken straight from the client, no check of the extension against an allow list, and a save location inside the web root.
Then look in the upload directory for files that should not be there. Script files in a folder meant for images are the thing to find:
find /var/www -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -path "*upload*"
Check file modification times against your last known good deployment. Any script you did not put there needs to be treated as an incident.
Safeguard's free in-browser dependency scan covers third party packages. It will not flag this issue, which sits in the application's own code, so use code review or a SAST tool for that part.
What to do now
- Decide whether the application needs to run. If it is a demo or an unused install, remove it.
- If it must stay up, take the admin area off the public internet. Limit it by IP address, VPN or HTTP authentication in front of the application.
- In the upload handler, accept only the image types you expect, using an allow list of extensions and a server side check of the real file type. Do not trust the type the browser reports.
- Store uploads outside the web root, or in a directory where the web server will not run scripts. Generate the stored file name yourself.
- Check the upload directory for unexpected script files and review access logs for posts to the admin handler.
- If you find a script you did not add, rebuild the server from a clean image and rotate every credential the application could read.
Why it matters
CWE-434 covers unrestricted upload of a dangerous file type, and CWE-284 is improper access control, the wider class. An upload feature is a way for a user to put a file on your server. If the server accepts any file, saves it where the web server can run it, and keeps the original name, the upload can turn into code execution. Even when it cannot, an attacker can fill the disk or host content on your domain.
The control that matters is not hiding the form. It is deciding on the server what may be stored, where, and under what name. Small sample projects tend to skip every one of those steps.
Quick check
Does the admin path protect the upload handler?
Not by itself. The CVSS vector in the record lists no privileges required. Put real authentication and network limits in front of the admin area, and fix the handler.
Is there a patched version?
The record lists none. Check the vendor site for a newer release, and if there is none, fix the upload code yourself or retire the application.
Sources
Last reviewed: 18 October 2026.
