| タイトル | Student-Management-System imranrisal-dev 1/1 Command Injection |
|---|
| 説明 | Vulnerability Title: Arbitrary File Upload Leading to Remote Code Execution (RCE)
Description:
The application is vulnerable to arbitrary file upload in both student and staff profile picture modules (student_profile_pic.php and staff_profile_pic.php). The system extracts the original filename from the $_FILES['choose_file'] parameter and uses it directly to construct the destination path within the publicly accessible /asset/upload/ directory.
The application lacks essential security controls, including file extension white-listing, MIME type validation, file content/header inspection, and filename randomization. An authenticated attacker can upload a malicious script (e.g., .php file) and subsequently execute it by accessing the file URL directly via the web server. This leads to arbitrary code execution on the underlying server with the privileges of the web application user. |
|---|
| ソース | ⚠️ https://github.com/sanjibsajid381-ctrl/My-Web-cve/issues/1 |
|---|
| ユーザー | HackEight (UID 99045) |
|---|
| 送信 | 2026年06月16日 15:45 (2 月 ago) |
|---|
| モデレーション | 2026年08月05日 11:55 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 386147 [imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage choose_file 特権昇格] |
|---|
| ポイント | 20 |
|---|