| Title | oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 Unrestricted Upload |
|---|
| Description | The affected components are the file-upload handlers that store files under the web root without any extension or content validation: `admin/insert.php` (customer photo, `costomerform`), `admin/employee_insert.php` (employee photo), `admin/photoupdate.php`, `admin/document_update.php` (document uploads) - all writing to `admin/user/` - and `admin/artical.php` writing to `admin/uploaded/`:
```php
$image=$_FILES['userfile']['name'];
$uploaddir='user/'.$image;
if(move_uploaded_file($tmp_file_name,$uploadimage)) { ... }
```
The uploaded filename is taken verbatim from the client, so `shell.php` is stored as `admin/user/shell.php` and is directly executable by the web server. Because the session check only redirects without exiting, all of these endpoints accept anonymous uploads. An attacker uploads a PHP web shell and then requests it to execute arbitrary server-side code (command execution, file read/write, database access) as the web-server user, i.e. complete server compromise. Note: in hardened environments where `system()`/`exec()` are disabled via `disable_functions`, PHP code execution itself still works (e.g. `file_get_contents('/etc/passwd')`, `file_put_contents()`), so the RCE remains proven.
|
|---|
| Source | ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/6 |
|---|
| User | Weaster (UID 102044) |
|---|
| Submission | 10/11/2026 15:44 (21 days ago) |
|---|
| Moderation | 10/27/2026 10:01 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 427078 [oretnom23 php-travel-agency-system employee_insert.php employee photo unrestricted upload] |
|---|
| Points | 20 |
|---|