CVE-2025-60500

QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/H4zaz/CVE-2025-60500	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:qdocs:smart_school:7.1.0:*:*:*:*:*:*:*

History

05 Nov 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El Sistema de Gestión Escolar Inteligente QDocs 7.1 permite a usuarios autenticados con roles como ’contable’ o ’administrador’ eludir las restricciones de tipo de archivo en la función de carga de medios abusando de la opción de URL alternativa de YouTube. Esta falla lógica permite la carga de archivos PHP arbitrarios, los cuales se almacenan en un directorio accesible desde la web.

Information

Published : 2025-10-21 17:15

Updated : 2026-11-05 22:10

NVD link : CVE-2025-60500

Mitre link : CVE-2025-60500

CVE.ORG link : CVE-2025-60500

JSON object : View

Products Affected

qdocs

smart_school

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2025-60500", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-60500", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-21T18:32:00.100159Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-10-21T17:15:40.047", "references": [{"url": "https://github.com/H4zaz/CVE-2025-60500", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "QDocs Smart School Management System 7.1 allows authenticated users with roles such as \"accountant\" or \"admin\" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a web-accessible directory."}, {"lang": "es", "value": "El Sistema de Gesti\u00f3n Escolar Inteligente QDocs 7.1 permite a usuarios autenticados con roles como \u2019contable\u2019 o \u2019administrador\u2019 eludir las restricciones de tipo de archivo en la funci\u00f3n de carga de medios abusando de la opci\u00f3n de URL alternativa de YouTube. Esta falla l\u00f3gica permite la carga de archivos PHP arbitrarios, los cuales se almacenan en un directorio accesible desde la web."}], "lastModified": "2026-11-05T22:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:qdocs:smart_school:7.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73D99BC7-4DF7-4C42-AD64-6850F2C04794"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}