| शीर्षक | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 Unrestricted Upload |
|---|
| विवरण | The affected component is `home.php` (site root), the unauthenticated "Criminal Information" form that stores a criminal photo. The upload handler trusts the client-provided filename and moves the file into the web root without any authentication or validation of the file type, extension, or content:
```php
$fname=$_FILES['my_img']['name'];
$tmpname=$_FILES['my_img']['tmp_name'];
$folder="images/".$fname;
move_uploaded_file($tmpname, $folder);
```
Because the endpoint requires no login (no session check anywhere in `home.php`), any remote attacker can upload an arbitrary PHP script (e.g., `shell.php`) into the web-accessible `images/` directory and then request it directly to execute arbitrary PHP code in the context of the web server, including reading application files (verified against `config.php`) and, on default PHP configurations where command execution functions are not disabled, executing operating system commands. This leads to full application and server compromise.
|
|---|
| स्रोत | ⚠️ https://github.com/vraj404/Criminal-Management-System/issues/1 |
|---|
| उपयोगकर्ता | Wuwj (UID 101900) |
|---|
| सबमिशन | 05/10/2026 05:22 PM (17 दिन पहले) |
|---|
| संयम | 19/10/2026 07:50 AM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 422256 [vraj404 Criminal-Management-System तक 2808d057e7ddc5295519a487365b0cacfd0ba8c4 home.php move_uploaded_file my_img अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|