| Título | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 Unrestricted Upload |
|---|
| Descripción | The affected component is `home.php` (site root), the unauthenticated "Criminal Information" form that stores a criminal photo. The upload handler trusts the client-provided filename and moves the file into the web root without any authentication or validation of the file type, extension, or content:
```php
$fname=$_FILES['my_img']['name'];
$tmpname=$_FILES['my_img']['tmp_name'];
$folder="images/".$fname;
move_uploaded_file($tmpname, $folder);
```
Because the endpoint requires no login (no session check anywhere in `home.php`), any remote attacker can upload an arbitrary PHP script (e.g., `shell.php`) into the web-accessible `images/` directory and then request it directly to execute arbitrary PHP code in the context of the web server, including reading application files (verified against `config.php`) and, on default PHP configurations where command execution functions are not disabled, executing operating system commands. This leads to full application and server compromise.
|
|---|
| Fuente | ⚠️ https://github.com/vraj404/Criminal-Management-System/issues/1 |
|---|
| Usuario | Wuwj (UID 101900) |
|---|
| Sumisión | 2026-10-05 17:22 (hace 23 días) |
|---|
| Moderación | 2026-10-19 07:50 (14 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 422256 [vraj404 Criminal-Management-System hasta 2808d057e7ddc5295519a487365b0cacfd0ba8c4 home.php move_uploaded_file my_img escalada de privilegios] |
|---|
| Puntos | 20 |
|---|