| शीर्षक | SourceCodester Prison Management System Using PHP V1.0 Unrestricted Upload |
|---|
| विवरण | The `edit-photo.php` file (path: `/Employee/edit-photo.php`) in the target application has a critical unrestricted file upload vulnerability, combined with a web server file parsing flaw. Attackers can bypass upload detection via **double suffix obfuscation** ( shell.php.jpg), where the application only validates the final suffix while the server parses the first valid PHP suffix. This allows uploading malicious PHP files that are executed by the server, leading to arbitrary system command execution (RCE). |
|---|
| स्रोत | ⚠️ https://github.com/hater-us/CVE/issues/9 |
|---|
| उपयोगकर्ता | Hater (UID 94862) |
|---|
| सबमिशन | 30/01/2026 08:11 PM (8 महीनों पहले) |
|---|
| संयम | 07/02/2026 04:06 PM (8 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 263104 [SourceCodester Prison Management System 1.0 /Employee/edit-photo.php userImage अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|