| शीर्षक | SourceCodester Online Book Store System 1.0 Remote Code Execution |
|---|
| विवरण | A critical authenticated Remote Code Execution vulnerability exists in SourceCodester Online Book Store System 1.0.
The Book Management functionality allows authenticated administrators to upload arbitrary files without proper validation of file extension, MIME type, or executable content.
An attacker can upload a malicious PHP web shell through the book image upload feature. The uploaded file is stored inside a web-accessible directory and executed by the PHP interpreter when accessed through the browser.
Successful exploitation allows arbitrary operating system command execution with the privileges of the web server process, leading to complete compromise of the application and potentially the underlying server.
CWE: CWE-434
CVSS v3.1: 9.1 (Critical) |
|---|
| स्रोत | ⚠️ https://medium.com/@hemantrajbhati5555/critical-authenticated-remote-code-execution-rce-via-unrestricted-file-upload-5a4a313ea1f1 |
|---|
| उपयोगकर्ता | Hemant Raj Bhati (UID 95613) |
|---|
| सबमिशन | 10/06/2026 01:57 PM (1 महीना पहले) |
|---|
| संयम | 12/07/2026 08:04 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 377889 [SourceCodester Online Book Store System 1.0 Book Image Upload Feature index.php?page=books अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|