| शीर्षक | SourceCodester Contact Tracing System 1/11 Unrestricted Upload of File with Dangerous Type |
|---|
| विवरण | SourceCodester Contact Tracing System (commit be41d42) allows unauthenticated remote code execution. classes/Users.php exposes the f=save and f=delete actions with no authentication or authorization check. The save handler builds INSERT INTO users from raw POST keys (any row is an admin since the users table has no role column) and calls move_uploaded_file() on $_FILES['img'] into uploads/ with no extension, MIME, or content validation. An unauthenticated attacker creates an admin account, uploads a PHP web shell, and executes OS commands; live reproduction returned uid=0(root). The same endpoint also has a pre-auth SQL injection in the id parameter of the delete action. CVSS 3.1 score 9.8 Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Discovered by Santhosh Kumar, TraceX Labs. Vendor contact attempted via SourceCodester contact form (blocked by spam filter); public disclosure published at https://tracexlabs.com/releases/contact-tracing-preauth-rce.html. |
|---|
| स्रोत | ⚠️ https://tracexlabs.com/releases/contact-tracing-preauth-rce.html |
|---|
| उपयोगकर्ता | SanthoshKumar (UID 101638) |
|---|
| सबमिशन | 25/09/2026 04:05 PM (18 दिन पहले) |
|---|
| संयम | 11/10/2026 10:00 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416792 [SourceCodester Contact Tracing System 1.0 Users.php?f=save move_uploaded_file img/id अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|