Vulnerability · Published Jun 7, 2025 · Assigned by VulDB

CVE-2025-5840SourceCodester Client Database Management System user_update_customer_order.php unrestricted upload

High 7.3

In plain English

A high-severity unrestricted file upload in Client Database Management System from SourceCodester. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_update_customer_order.php. The manipulation of the argument uploaded_file leads to unrestricted upload. It is possible to initiate the attack remotely.

Affected products (as reported)

Vendor	Product	Versions
SourceCodester	Client Database Management System	1.0

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References

VDB-311583 | SourceCodester Client Database Management System user_update_customer_order.php unrestricted upload vdb-entry, technical-description
VDB-311583 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #591425 | SourceCodester Client Database Management System v1.0 file upload third-party-advisory
https://github.com/592833263/cve/issues/1 issue-tracking
https://www.sourcecodester.com/ product