dotadrien/cve-2025-60655Proof-of-concept for CVE-2025-60655: Remote Code Execution via unrestricted file upload bypassing client-side JavaScript validation, enabling arbitrary PHP script execution on the server.
A critical vulnerability in the image upload system allows for Remote Code Execution (RCE). The application relies solely on client-side JavaScript to validate file types. By bypassing these JS checks, an attacker can upload malicious PHP scripts. Combined with a SQL injection to retrieve the file path, the attacker can execute arbitrary code on the server.
