CVE-2025-69559: Computer Book Store 1.0 Unrestricted File Upload
CVE-2025-69559 describes a file upload weakness (CWE-434) in admin_add.php of code-projects Computer Book Store 1.0, scored 9.8 Critical under CVSS 3.1 in the record. The record lists no fixed version and CISA KEV does not list the CVE. Defenders should restrict access to administrative functions and validate uploads while awaiting an authoritative fix.
Overview
CVE-2025-69559 is a file upload weakness reported in code-projects Computer Book Store 1.0, specifically in admin_add.php. The record classifies it as CWE-434, Unrestricted Upload of File with Dangerous Type. Sources: NVD entry.
Impact
- The record reports a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
- Per that vector, the attack is network-reachable, needs no privileges or user interaction, and has high impact on confidentiality, integrity and availability.
- Inference: an unrestricted upload can let an attacker place unintended files on the server. The record does not describe the concrete consequences.
Affected products and versions
- The record lists the affected product as Carmelo Computer Book Store, version 1.0.
- The description names code-projects Computer Book Store 1.0. The vendor and product naming differs between fields, so administrators should verify which software they run.
- No fixed version is listed. This means the sources consulted did not provide one, not that no fix exists.
Exploitation status
CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. One third-party reference is tagged as exploit-related. Its contents were not reproduced here, and this portal does not publish exploit details.
Remediation and mitigation
- Identify any deployment of this application, especially its administrative interface.
- Limit access to administrative paths to trusted networks and accounts until a fix or authoritative guidance is available.
- Validate uploads on the server: use an allowlist of extensions, check file content, store uploads outside executable web paths, and assign generated file names.
- Remove or replace unmaintained demonstration applications.
Detection guidance
- Review web server logs for unexpected requests to admin_add.php and for unfamiliar entries in upload directories.
- Monitor upload and public directories for script or executable files that were not expected.
Limitations of the available information
- The record does not identify the vulnerable parameter, the exact upload logic, or the preconditions beyond the CVSS vector.
- No fixed version, vendor advisory or EPSS score is present in the record.
- The vendor and product names conflict between the description and the affected product field.
Frequently asked questions
Is CVE-2025-69559 being actively exploited?
CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. One third-party reference is tagged as exploit-related, but that does not confirm exploitation.
Is there a fixed version for this vulnerability?
The record does not list a fixed version. This means no fix was identified in the sources consulted, so administrators should check the vendor or maintainer for current guidance.
What should I do now?
Confirm whether you run this application, restrict access to its administrative pages, validate uploaded files on the server, and review logs for unexpected requests to admin_add.php.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.