| शीर्षक | SourceCodester Online Faculty Clearance System using PHP/MySQL with Source Code V1.0 / production/edit_picture.php 1.0 Unrestricted Upload |
|---|
| विवरण | uring the security review of the OnlineClearance faculty profile picture feature, I found that authenticated users can submit a multipart file upload to production/edit_picture.php.
The backend stores the uploaded file using the original client-supplied filename:
$a = $_FILES['file']['name'];
$ab = $_FILES['file']['tmp_name'];
$location = "".$a;
move_uploaded_file($ab, "../requirements/".$location);
Because the application does not validate the file extension, MIME type, or file contents, an attacker can upload a PHP payload by naming the file shell.php.
In testing, the uploaded payload was then executed successfully from /OnlineClearance/requirements/shell.php, confirming remote code execution. |
|---|
| स्रोत | ⚠️ https://github.com/zzjzzzj389/cve/issues/1 |
|---|
| उपयोगकर्ता | plutoyrw (UID 100582) |
|---|
| सबमिशन | 16/08/2026 08:14 AM (1 महीना पहले) |
|---|
| संयम | 14/09/2026 05:51 PM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403588 [SourceCodester Online Faculty Clearance System 1.0 Profile Picture Upload edit_picture.php move_uploaded_file Arquivo अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|