| Название | Student-Management-System imranrisal-dev 1/1 Command Injection |
|---|
| Описание | Vulnerability Title: Arbitrary File Upload Leading to Remote Code Execution (RCE)
Description:
The application is vulnerable to arbitrary file upload in both student and staff profile picture modules (student_profile_pic.php and staff_profile_pic.php). The system extracts the original filename from the $_FILES['choose_file'] parameter and uses it directly to construct the destination path within the publicly accessible /asset/upload/ directory.
The application lacks essential security controls, including file extension white-listing, MIME type validation, file content/header inspection, and filename randomization. An authenticated attacker can upload a malicious script (e.g., .php file) and subsequently execute it by accessing the file URL directly via the web server. This leads to arbitrary code execution on the underlying server with the privileges of the web application user. |
|---|
| Источник | ⚠️ https://github.com/sanjibsajid381-ctrl/My-Web-cve/issues/1 |
|---|
| Пользователь | HackEight (UID 99045) |
|---|
| Представление | 16.06.2026 15:45 (2 месяцы назад) |
|---|
| Модерация | 05.08.2026 11:55 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 386147 [imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage choose_file эскалация привилегий] |
|---|
| Баллы | 20 |
|---|