An authenticated path traversal vulnerability in SourceCodester Pet Grooming Management System 1.0 poses a significant risk of arbitrary file deletion, potentially leading to complete system compromise.

This is a path traversal vulnerability located in the admin/manage_website.php file. The flaw permits an authenticated user with administrative privileges to execute arbitrary file deletions by submitting a malicious POST request.

The ability for an administrative user to delete arbitrary files on the underlying operating system can result in severe service disruption, data loss, or the deletion of critical system configuration files. With a CVSS score of 8.2, this vulnerability is considered high severity, as it provides a path for an attacker to effectively sabotage the application environment or render the server non-functional.

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the administrative dashboard to trusted personnel only and consider disabling the application until a security update is released.

Proactive Monitoring: Monitor server access logs for unusual POST requests targeting the manage_website.php endpoint, specifically looking for directory traversal sequences like double dots or absolute path references.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block POST requests that contain suspicious path traversal patterns directed at administrative components.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository z3rObyte/CVE-2025-63298.

Given the availability of a public proof-of-concept and the high potential for system-level damage, this vulnerability presents a significant operational risk. Organizations should immediately audit their administrative access controls and implement strict network-level restrictions to prevent unauthorized interaction with the vulnerable endpoint while awaiting a formal vendor patch.