z3robyte/cve-2025-63298Proof-of-concept exploit for a path traversal vulnerability in SourceCodester Pet Grooming Management System 1.0, allowing authenticated admins to delete arbitrary files via crafted POST requests.
A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php component. An authenticated user with administrative privileges can leverage this flaw by submitting a specially crafted POST request, enabling the deletion of arbitrary files on the web server.
There is a vulnerable function that will delete every file we put into the 'old_login_image' POST parameter by performing a path traversal.
It is possible to delete index.php, which will result in a denial of service.
Discovered by Z3robyte on October 2025
