A vulnerability classified as critical was found in code-projects Online Shoe Store 1

CVE-2025-0206 is an access-control failure in code-projects Online Shoe Store 1.0, specifically the /admin/index.php path. The public write-up says a normal user can reach the admin panel directly; the project page also advertises a built-in sign-up flow, so in many deployments an attacker may be able to self-register first and then browse straight into admin. The affected version range publicly identified is just 1.0.

The vendor-side 5.3 MEDIUM is directionally closer to reality than the NVD's enriched 8.8 HIGH, but for enterprise patch planning I would still score it lower. The exploit is easy and public, but the real-world exposure population is tiny: this is a downloadable PHP student project typically run on XAMPP/WAMP, not a mainstream enterprise platform, and the demonstrated impact is application-admin takeover rather than verified server takeover.

Why this verdict

• Downward pressure: niche product — code-projects is distributing sample PHP source code, not a mainstream enterprise application stack. That massively narrows the exposed population.
• Downward pressure: likely post-initial or self-registration dependent — the public PoC says log in as a normal user first. If registration is not open, this is a true low-privilege post-auth issue.
• Downward pressure: blast radius is app-level — the retrieved sources show admin-panel takeover, but not RCE, container escape, or host takeover.
• Upward pressure: exploitation is easy — the path is direct, the PoC is public, and the route is a simple request to /admin/index.php after obtaining user context.
• Upward pressure: remote and quiet — this is normal-looking web traffic, so weakly monitored hobby apps can be compromised without much noise.

Why not higher?

Because several prerequisites shrink the real-world risk fast: you need this exact PHP sample app deployed somewhere that matters, reachable, and still using the vulnerable code path. Even then, the demonstrated impact in the public material is application-admin access, not system-level compromise or broad tenant-to-tenant spread.

Why not lower?

Because if the app is present and exposed, the exploit path is cheap and realistic. Public PoC exists, the authorization check appears absent, and admin-panel access can still expose customer and order data or enable storefront tampering.

1. Put /admin behind real authentication — Require an upstream control such as reverse-proxy auth, VPN-only reachability, or IP allowlisting so direct requests to /admin/index.php never hit the app anonymously. For a LOW verdict there is no SLA — treat as backlog hygiene, but do it immediately if this app is internet-facing.
2. Disable self-registration where possible — The easiest abuse path is likely self-signup to low-privilege user and then direct browse to the admin page. If the site must stay up, turning off open registration sharply raises attacker cost; for LOW, this is backlog hygiene unless the instance is exposed to the internet.
3. Add a server-side role check in admin/index.php — Do not rely on hidden links or UI gating; enforce a session and explicit admin-role validation before any admin page renders. No formal LOW mitigation deadline applies, but any live production instance should get this code fix before the next normal release cycle.
4. Watch for user-to-admin jumps — Log and alert on fresh accounts hitting /admin/ paths, especially within minutes of registration. This is cheap detective control for an app that likely lacks mature security instrumentation; again, LOW means backlog hygiene unless the app is externally reachable.

Run this on the target host or a mounted application source tree, not from a scanner workstation. Invoke it as python3 check_cve_2025_0206.py /var/www/html/online-shoe-store; no root is required, only read access to the app files. It performs a source-level heuristic check of admin/index.php and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env python3
# check_cve_2025_0206.py
# Heuristic verifier for CVE-2025-0206 in code-projects Online Shoe Store 1.0
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE/ERROR

import os
import re
import sys

ROLE_PATTERNS = [
    r'\$_SESSION\s*\[\s*["\']admin["\']\s*\]',
    r'\$_SESSION\s*\[\s*["\']role["\']\s*\]',
    r'\$_SESSION\s*\[\s*["\']user_type["\']\s*\]',
    r'\$_SESSION\s*\[\s*["\']is_admin["\']\s*\]',
    r'if\s*\(!?\s*isset\s*\(\s*\$_SESSION',
    r'header\s*\(\s*["\']Location\s*:',
    r'include\s*\(.*auth',
    r'require(_once)?\s*\(.*auth',
]

WEAK_SIGNALS = [
    r'admin',
    r'dashboard',
    r'orders',
    r'products',
    r'transactions',
]

def out(msg, code):
    print(msg)
    sys.exit(code)

if len(sys.argv) != 2:
    out('UNKNOWN - usage: python3 check_cve_2025_0206.py <app_root>', 3)

root = sys.argv[1]
index_path = os.path.join(root, 'admin', 'index.php')

if not os.path.isdir(root):
    out('UNKNOWN - supplied app_root does not exist', 3)

if not os.path.isfile(index_path):
    out('UNKNOWN - admin/index.php not found', 2)

try:
    with open(index_path, 'r', encoding='utf-8', errors='ignore') as f:
        data = f.read()
except Exception as e:
    out(f'UNKNOWN - unable to read file: {e}', 2)

head = data[:8000]  # inspect early file content where auth gates usually live
found_role_guard = any(re.search(p, head, re.IGNORECASE | re.DOTALL) for p in ROLE_PATTERNS)
weak_context = sum(1 for p in WEAK_SIGNALS if re.search(p, data, re.IGNORECASE))

# Heuristic verdict logic
if found_role_guard:
    out('PATCHED - admin/index.php appears to contain session/role/auth gating', 0)

if weak_context >= 2:
    out('VULNERABLE - admin/index.php exists and no obvious session/role/auth guard was found', 1)

out('UNKNOWN - file exists but heuristic evidence is inconclusive', 2)

Sources

1. NVD CVE-2025-0206 detail
2. NVD CPE entry for code-projects Online Shoe Store 1.0
3. Code-Projects product page
4. Code-Projects download details
5. Public GitHub gist PoC by th4s1s
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. FIRST EPSS API documentation