| tiêu đề | Student-Management-System imranrisal-dev 1/1 Command Injection |
|---|
| Mô tả | Vulnerability Title: Arbitrary File Upload Leading to Remote Code Execution (RCE)
Description:
The application is vulnerable to arbitrary file upload in both student and staff profile picture modules (student_profile_pic.php and staff_profile_pic.php). The system extracts the original filename from the $_FILES['choose_file'] parameter and uses it directly to construct the destination path within the publicly accessible /asset/upload/ directory.
The application lacks essential security controls, including file extension white-listing, MIME type validation, file content/header inspection, and filename randomization. An authenticated attacker can upload a malicious script (e.g., .php file) and subsequently execute it by accessing the file URL directly via the web server. This leads to arbitrary code execution on the underlying server with the privileges of the web application user. |
|---|
| Nguồn | ⚠️ https://github.com/sanjibsajid381-ctrl/My-Web-cve/issues/1 |
|---|
| Người dùng | HackEight (UID 99045) |
|---|
| Đệ trình | 16/06/2026 15:45 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 05/08/2026 11:55 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 386147 [imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage choose_file nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|