| عنوان | itsourcecode Payroll System 1.0 Unrestricted Upload |
|---|
| الوصف | Description:
The `save_settings()` function handles file uploads with zero validation. No extension allowlist, no MIME type verification, no content inspection. Uploaded files retain their original filename and extension, and are stored in the web-accessible `assets/img/` directory. Combined with missing authentication (VULN-01), an unauthenticated attacker can upload and execute arbitrary PHP code.
Vulnerable Code:
**File**: `admin_class.php`, Lines 100-129
```php
function save_settings(){
extract($_POST);
$data = " name = '".str_replace("'","’",$name)."' ";
$data .= ", email = '$email' ";
$data .= ", contact = '$contact' ";
$data .= ", about_content = '".htmlentities(str_replace("'","’",$about))."' ";
if($_FILES['img']['tmp_name'] != ''){
$fname = strtotime(date('y-m-d H:i')).'_'.$_FILES['img']['name'];
$move = move_uploaded_file($_FILES['img']['tmp_name'],'assets/img/'. $fname);
$data .= ", cover_img = '$fname' ";
}
// ...
}
```
- No extension allowlist
- No MIME type validation (`getimagesize()`, `finfo`)
- No file content inspection
- Original filename and extension preserved (`$_FILES['img']['name']`)
- Files stored in web-accessible `assets/img/`
Proof of Concept:
**Upload PHP webshell**:
```http
POST /ajax.php?action=save_settings HTTP/1.1
Host: localhost:8093
Content-Type: multipart/form-data; boundary=----Boundary
Impact:
- Remote Code Execution on the web server
- Complete server compromise
- Data exfiltration, malware deployment, lateral movement
- Zero authentication required — fully unauthenticated RCE
Reference: https://github.com/microwaveabi/vul/issues/12 |
|---|
| المصدر | ⚠️ https://github.com/microwaveabi/vul/issues/12 |
|---|
| المستخدم | microwave (UID 96185) |
|---|
| ارسال | 11/07/2026 05:17 AM (1 شهر منذ) |
|---|
| الاعتدال | 24/08/2026 12:50 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 394579 [itsourcecode Payroll System 1.0 admin_class.php save_settings img تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|