| Название | SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0 Unrestricted Upload |
|---|
| Описание | A vulnerability was discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. The issue affects upload_files.php.
An authenticated instructor can upload arbitrary PHP files through the file upload functionality. The application extracts the file extension but does not validate it against an allowlist and does not perform MIME-type verification. Uploaded files are stored in the web-accessible directory uploads/class_docs/ and are directly accessible via HTTP.
By uploading a PHP payload such as test.php and accessing the generated file URL, arbitrary PHP code is executed on the server.
This vulnerability allows authenticated remote code execution and may result in full compromise of the application and underlying server.
|
|---|
| Источник | ⚠️ https://pastebin.com/PNJvBZwT |
|---|
| Пользователь | ameenkbrd (UID 98192) |
|---|
| Представление | 03.06.2026 14:53 (1 месяц назад) |
|---|
| Модерация | 04.07.2026 07:19 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 376294 [SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php эскалация привилегий] |
|---|
| Баллы | 17 |
|---|