Vulnerability · Published Oct 7, 2025 · Assigned by VulDB
CVE-2025-11353code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload
Medium 6.3
In plain English
A medium-severity unrestricted file upload in Online Hotel Reservation System from code-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
A vulnerability was detected in code-projects Online Hotel Reservation System 1.0. This impacts an unknown function of the file /admin/addgalleryexec.php. Performing manipulation of the argument image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| code-projects | Online Hotel Reservation System | 1.0 |
Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-327238 | code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload vdb-entry, technical-description
- VDB-327238 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #664920 | code-projects Online Hotel Reservation System V1.0 Unrestricted Upload third-party-advisory
- https://github.com/zhicat/C/issues/30 exploit, issue-tracking
- https://code-projects.org/ product