| Titolo | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Unrestricted Upload |
|---|
| Descrizione | The affected components are `upload_save.php` (downloadable-material upload) and `teacher_avatar.php` (profile picture upload). `upload_save.php` only rejects the literal extension `exe` and the MIME type `application/x-msdownload`, and then stores the file with its original name under the web-served directory `admin/uploads/`:
```php
$rd2 = mt_rand(1000, 9999) . "_File";
if ((!empty($_FILES["uploaded_file"])) && ($_FILES['uploaded_file']['error'] == 0)) {
$filename = basename($_FILES['uploaded_file']['name']);
$ext = substr($filename, strrpos($filename, '.') + 1);
if (($ext != "exe") && ($_FILES["uploaded_file"]["type"] != "application/x-msdownload")) {
$newname = "admin/uploads/" . $rd2 . "_" . $filename;
if (!file_exists($newname)) {
if ((move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $newname))) {
```
`teacher_avatar.php` performs no validation at all — it moves the uploaded file to `admin/uploads/` keeping the attacker-controlled original filename:
```php
move_uploaded_file($_FILES["image"]["tmp_name"], "admin/uploads/" . $_FILES["image"]["name"]);
$location = "uploads/" . $_FILES["image"]["name"];
mysql_query("update teacher set location = '$location' where teacher_id = '$session_id' ")or die(mysql_error());
```
Both endpoints require only a normal teacher session (obtainable for free through the login SQL injection of CVE-01 / signup takeover of CVE-03). Uploading a file named `poc.php` is accepted; because the file lands inside the web root under a predictable path, requesting that URL executes the attacker's PHP code with web-server privileges — full remote code execution. The `Content-Type` header and the `getimagesize()` call in `teacher_avatar.php` are never enforced, and the MIME check in `upload_save.php` is trivially spoofed.
|
|---|
| Fonte | ⚠️ https://github.com/KusalkaSilva/Learning-Management-System/issues/6 |
|---|
| Utente | vuldb2026 (UID 101467) |
|---|
| Sottomissione | 22/09/2026 17:45 (1 mese fa) |
|---|
| Moderazione | 11/10/2026 19:30 (19 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 416735 [KusalkaSilva Learning-Management-System fino a ffeb873f8803f1e9664384ff75000c7da45466d2 upload_save.php getimagesize uploaded_file/image escalationi di privilegi] |
|---|
| Punti | 20 |
|---|