| タイトル | Kushan2k student-management-system 1.0 Unrestricted File Upload |
|---|
| 説明 | The student registration form allows uploading a profile image (`stimg`). The server‑side code in `RegisterService.php` only checks the file size, then moves the uploaded file directly to the web‑accessible directory `public/profiles/` without any validation of file extension, MIME type, or content:
```php
$img = $files['stimg'];
$UPLOAD_DIR = '../public/profiles/';
if ($img["size"] > 5000000) { ... }
$img_url = $UPLOAD_DIR . time() . basename($img['name']);
if (!move_uploaded_file($img['tmp_name'], $img_url)){
$_SESSION['error'] = 'file upload error!';
return;
}
```
The server is configured to execute PHP scripts located inside public/profiles/. An attacker can therefore register a new student (or impersonate an existing one if the form lacks authentication) and upload a .php file (e.g., a web shell) as the profile image. The file is saved with a predictable name (UNIX_TIMESTAMP + original filename), and the attacker can then request it directly, achieving remote code execution.
Steps to Reproduce
Prepare a minimal PHP payload, e.g., <?php echo 'RCE_POC_123'; ?>.
Send a multipart POST request to the registration endpoint (controllers/RegisterController.php) with all required fields and the stimg field containing the PHP file. Set the filename to poc.php.
The server responds with a redirect or success message, and the file is saved as public/profiles/{timestamp}poc.php.
Retrieve the file name from the response (e.g., by checking the profile page or predicting the timestamp) and request it directly:
GET /public/profiles/1779255153poc.php
The server returns RCE_POC_123, confirming code execution. |
|---|
| ソース | ⚠️ https://github.com/Kushan2k/student-management-system/issues/1 |
|---|
| ユーザー | SweetSour (UID 98392) |
|---|
| 送信 | 2026年05月20日 08:08 (23 日 ago) |
|---|
| モデレーション | 2026年06月07日 11:37 (18 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 369094 [Kushan2k student-management-system 迄 f16a4ceaddd6729c4b306ed4641cda3176c1ef2a Registration Endpoint RegisterService.php stimg 特権昇格] |
|---|
| ポイント | 20 |
|---|