提出 #696606: Campcodes Advanced Online Voting Management System V1.0 Unrestricted Upload

# Advanced Online Voting System Unrestricted Upload

## Vendor Homepage

www.campcodes.com

## submitter

H1m

## Vulnerable File

- /voters.php

## VERSION(S)

- V1.0

## Software Link

- https://www.campcodes.com/projects/php/online-voting-system-in-php/

## Vulnerability Type

- Unrestricted Upload

## Root Cause

Advanced Online Voting System In PHP With Source Code v1.0 /voters.php,After logging in, Upload new documents when adding content to a page without any restrictions or filtering leads to an unlimited upload vulnerability.

## Impact

File upload vulnerabilities are extremely harmful. Attackers can upload malicious scripts (such as WebShell) to directly control the server, view, tamper with or delete files, execute system commands, and even create administrator accounts. The server may become a "zombie" and be used for DDoS attacks, sending spam, etc. At the same time, the database is vulnerable to intrusion, sensitive information such as user privacy and commercial secrets may be stolen or tampered with, and website pages may be maliciously replaced, damaging the platform's reputation. In addition, the vulnerability may also become a springboard for attacking other systems, triggering chain security issues and posing multi-dimensional threats to servers, data and users.

# DESCRIPTION
Advanced Online Voting System, source code v1.0. After logging in, Upload new documents when adding content to a page,In the page voters.php, the upload function in the /voters.php file was referenced, triggering an unlimited upload vulnerability. There are no restrictions or filters. Remote attackers can pass malicious loads through this file upload function, causing file uploads to be unrestricted and further leading to remote code execution (RCE).

# Vulnerability Details

## The process of vulnerability emergence
Open the main page and then select "voters"

< img width="1382" height="726" alt="Image" src="https://github.com/user-attachments/assets/310aa5b9-2b68-4740-abaf-1a503f6101f6" />

Clicking "Add User" reveals that photos can be uploaded. Upload a one-line Trojan
< img width="2005" height="794" alt="Image" src="https://github.com/user-attachments/assets/c28fe339-bd62-4efa-896b-4d11b4c73eda" />

Then locate the image position
< img width="2517" height="661" alt="Image" src="https://github.com/user-attachments/assets/449acb7a-7b35-4ca8-88ab-3a22df38b12a" />
execute command

< img width="1903" height="1226" alt="Image" src="https://github.com/user-attachments/assets/60c33242-1618-4d45-a44f-df81c90c3b70" />

# Suggested repair
1.**Strictly validate uploaded files:**
Validate file types and extensions rigorously.
Verify MIME types on both client and server sides.
Perform content inspection to prevent disguised malicious files.

2.**Store uploaded files outside the web root:**
This prevents direct access and execution of uploaded files from the web.

3.**Apply strict file system permissions:**
Disable execution permissions on upload directories.
Ensure uploaded files cannot be directly executed.

4.**Use secure file upload libraries or frameworks:**
Leverage established libraries that offer secure file upload mechanisms.

• ソース: ⚠️ https://github.com/F1shDreAm/CVE/issues/1
• ユーザー: H1mm (UID 92686)
• 送信: 2025年11月17日 11:19 (11 月 ago)
• モデレーション: 2025年11月22日 16:37 (5 days later)
• ステータス: 重複
• VulDBエントリ: 327353 [Campcodes Advanced Online Voting Management System 1.0 /admin/voters_add.php photo 特権昇格]
• ポイント: 0