| Title | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 Unrestricted Upload |
|---|
| Description | The affected component is the `save_files()` method of `admin_class.php`, invoked by `ajax.php?action=save_files`. The uploaded file keeps the client-supplied filename and extension and is moved into the web-accessible `assets/uploads/` directory without any extension, MIME, or content validation:
```php
$fname = strtotime(date('y-m-d H:i')).'_'.$_FILES['upload']['name'];
$move = move_uploaded_file($_FILES['upload']['tmp_name'],'assets/uploads/'. $fname);
```
`ajax.php` performs no authentication, so the upload works without any session (the file is written and executed even though the accompanying database insert can fail). An attacker uploads a `.php` file; its name is `<minute-timestamp>_<original name>` (the timestamp prefix is predictable to the minute), and the file is then executed by requesting `assets/uploads/<name>` — resulting in arbitrary PHP code execution on the server.
|
|---|
| Source | ⚠️ https://github.com/oretnom23/file-management-system-php/issues/7 |
|---|
| User | Zeming Hu (UID 101971) |
|---|
| Submission | 10/07/2026 16:12 (15 days ago) |
|---|
| Moderation | 10/21/2026 08:55 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424691 [oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 admin_class.php save_files upload unrestricted upload] |
|---|
| Points | 20 |
|---|