A vulnerability was found in Campcodes School Faculty Scheduling System 1

CVE-2025-0211 is a file inclusion bug in Campcodes School Faculty Scheduling System 1.0, specifically in /admin/index.php, where the page parameter is passed straight into include $page.'.php'. The public PoC shows php://filter/convert.base64-encode/resource=index, which turns this into authenticated local file read of PHP source and likely configuration material. Authoritative records only identify version 1.0 as affected; I did not find a vendor-fixed release or distro backport.

The vendor/CNA 6.3 MEDIUM is closer to reality than NVD's 9.8 CRITICAL. The decisive friction is PR:L: this sits behind the admin/staff side, so the attacker generally needs valid credentials or an existing session before the bug matters. That makes it a post-initial-access amplifier with partial impact, not an internet-scale unauthenticated takeover.

Why this verdict

• Start from the vendor's 6.3, not NVD's 9.8: the CNA vector includes PR:L, and the PoC is aimed at the admin interface with an authenticated cookie context, so the vendor baseline is the right anchor.
• Attacker position pushes this down: requiring authenticated remote access means this is usually post-initial-access, credential abuse, or session theft. That is compounding downward pressure versus any unauthenticated edge bug.
• Reachable population is narrow: Campcodes distributes this as a small PHP source-code project for XAMPP/LAMP-style installs, not as a mainstream enterprise control plane. Even vulnerable installs are unlikely to be numerous in large managed fleets.
• Impact is partial, not proven takeover: the public PoC demonstrates file read via php://filter, which can leak source and secrets, but the reviewed sources do not prove code execution or full host compromise from this CVE alone.
• Still not LOW because exploitation is cheap once inside: there is a public PoC, the bug is one parameter in a predictable admin route, and file disclosure can hand an attacker the next set of keys.

Why not higher?

This is not an unauthenticated internet-edge compromise in practice. The chain depends on prior authenticated access to an admin-side route, and the public evidence shows partial technical impact rather than demonstrated full-system takeover.

Why not lower?

Once the attacker has a valid session, exploitation is trivial and well-documented. Reading PHP source and config from a live web app can expose database credentials and make follow-on compromise much easier, so this is more than backlog lint.

1. Put /admin behind a trust boundary — Restrict the admin/staff path to VPN, campus IP ranges, or a reverse proxy allowlist so the authenticated prerequisite becomes much harder to satisfy. For a MEDIUM verdict there is no noisgate mitigation SLA; do this in the next normal change window if the app must remain online.
2. Kill default and weak credentials — Reset any installer or demo credentials, enforce long unique passwords, and add MFA or SSO in front of the app if possible. This directly attacks the biggest exploit prerequisite; for MEDIUM, there is no noisgate mitigation SLA, but do not leave published sample credentials in production.
3. Add a WAF or proxy rule for page= abuse — Block requests where page contains php://, .., absolute paths, URL-encoded traversal, or wrapper syntax. This is a practical shield for internet-exposed instances while you decide whether to locally patch or retire the app; for MEDIUM, there is no noisgate mitigation SLA.
4. Locally harden the include logic — Replace dynamic include-from-user-input with a strict allowlist of valid page names, or map routes to known files server-side. Because no vendor-fixed version was located, this may be your actual remediation path within the 365-day window.
5. Monitor for wrapper and traversal indicators — Alert on php://filter, convert.base64-encode, suspicious page= values, and repeated requests to /admin/index.php. This will not prevent exploitation, but it gives you a chance to catch active probing and credential abuse.

Run this on the target web server or against a mounted application directory, not from an auditor workstation. Invoke it as sudo bash check-cve-2025-0211.sh /var/www/html/school-faculty-scheduling-system and provide a path to the application root; it only needs read access to the code tree.

#!/usr/bin/env bash
# check-cve-2025-0211.sh
# Detects the vulnerable include pattern for CVE-2025-0211 in Campcodes School Faculty Scheduling System.
# Usage: bash check-cve-2025-0211.sh /path/to/app
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

set -u

APP_ROOT="${1:-}"
if [[ -z "$APP_ROOT" ]]; then
  echo "UNKNOWN: missing application path argument"
  exit 2
fi

TARGET="$APP_ROOT/admin/index.php"
if [[ ! -f "$TARGET" ]]; then
  echo "UNKNOWN: file not found: $TARGET"
  exit 2
fi

# Normalize line endings for matching.
CONTENT="$(tr -d '\r' < "$TARGET")"

# Strong indicator from the published PoC.
HAS_PAGE_ASSIGN=0
HAS_UNSAFE_INCLUDE=0
HAS_ALLOWLIST_HINT=0

if printf '%s' "$CONTENT" | grep -Eq "\$page *= *isset\(\$_GET\['page'\]\) *\? *\$_GET\['page'\] *: *'home'"; then
  HAS_PAGE_ASSIGN=1
fi

if printf '%s' "$CONTENT" | grep -Eq "include[[:space:]]+\$page[[:space:]]*\.[[:space:]]*'\.php'"; then
  HAS_UNSAFE_INCLUDE=1
fi

# Simple signs of local hardening.
if printf '%s' "$CONTENT" | grep -Eqi "in_array\(|switch[[:space:]]*\(|case[[:space:]]+'|preg_match\(|realpath\(|basename\("; then
  HAS_ALLOWLIST_HINT=1
fi

if [[ $HAS_PAGE_ASSIGN -eq 1 && $HAS_UNSAFE_INCLUDE -eq 1 ]]; then
  echo "VULNERABLE: unsafe user-controlled include pattern present in $TARGET"
  exit 1
fi

if [[ $HAS_ALLOWLIST_HINT -eq 1 ]]; then
  echo "PATCHED: unsafe include pattern not found and hardening indicators are present in $TARGET"
  exit 0
fi

if printf '%s' "$CONTENT" | grep -Eq "\$_GET\['page'\]|\$_REQUEST\['page'\]"; then
  echo "UNKNOWN: page parameter handling exists, but the exact published vulnerable pattern was not matched"
  exit 2
fi

echo "PATCHED: published vulnerable include pattern not found in $TARGET"
exit 0

Sources

1. NVD CVE-2025-0211
2. CVE Record
3. OpenCVE mirror with CNA timeline and CISA ADP SSVC
4. Public GitHub PoC
5. Campcodes project page
6. CISA Vulnerability Summary for the Week of December 30, 2024
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation