CVE-2025-57642
Published: 10 September 2025
Summary
CVE-2025-57642 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Sohamjuhin Tourism Management System. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A shell upload vulnerability tracked as CVE-2025-57642 affects the Tourism Management System version 2.0 and stems from unrestricted file upload handling classified under CWE-434. The flaw permits an authenticated user to upload arbitrary PHP scripts that the server will subsequently execute, resulting in remote code execution with full control over the affected host.
An attacker with high privileges and network access can exploit the issue by uploading a malicious PHP shell and invoking it through a web request. Successful exploitation grants the ability to execute arbitrary commands, exfiltrate sensitive data, and alter system functionality without requiring user interaction.
Public references consist of GitHub repositories containing proof-of-concept details and an issue report, but they do not describe vendor patches or mitigation steps. The associated EPSS score has remained flat at 0.0446 with no observed increase following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-27595
Vulnerability details
A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to remote code execution and unauthorized access to the system. This can result in the compromise…
more
of sensitive data and system functionality.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Shell upload vulnerability in public-facing web application (Tourism Management System) enables exploitation of public-facing application (T1190) to upload and execute arbitrary PHP web shells (T1100) for remote code execution.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.