| Title | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 Unrestricted Upload |
|---|
| Description | The affected component is `home.php` (site root), the unauthenticated "Criminal Information" form that stores a criminal photo. The upload handler trusts the client-provided filename and moves the file into the web root without any authentication or validation of the file type, extension, or content:
```php
$fname=$_FILES['my_img']['name'];
$tmpname=$_FILES['my_img']['tmp_name'];
$folder="images/".$fname;
move_uploaded_file($tmpname, $folder);
```
Because the endpoint requires no login (no session check anywhere in `home.php`), any remote attacker can upload an arbitrary PHP script (e.g., `shell.php`) into the web-accessible `images/` directory and then request it directly to execute arbitrary PHP code in the context of the web server, including reading application files (verified against `config.php`) and, on default PHP configurations where command execution functions are not disabled, executing operating system commands. This leads to full application and server compromise.
|
|---|
| Source | ⚠️ https://github.com/vraj404/Criminal-Management-System/issues/1 |
|---|
| User | Wuwj (UID 101900) |
|---|
| Submission | 10/05/2026 17:22 (23 days ago) |
|---|
| Moderation | 10/19/2026 07:50 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422256 [vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4 home.php move_uploaded_file my_img unrestricted upload] |
|---|
| Points | 20 |
|---|