提交 #696659: campcodes Advanced Online Voting System V1 Unrestricted Upload

# Advanced Online Voting System Unrestricted Upload

## Vendor Homepage

www.campcodes.com

## submitter

H1mm

## Vulnerable File

- /admin/candidates.php

## VERSION(S)

- V1.0

## Software Link

- https://www.campcodes.com/projects/php/online-voting-system-in-php/

## Vulnerability Type

- Unrestricted Upload

## Root Cause

Advanced Online Voting System In PHP With Source Code v1.0 /admin/candidates.php,After logging in, Upload new documents when adding content to a page without any restrictions or filtering leads to an unlimited upload vulnerability.

## Impact

File upload vulnerabilities are extremely harmful. Attackers can upload malicious scripts (such as WebShell) to directly control the server, view, tamper with or delete files, execute system commands, and even create administrator accounts. The server may become a "zombie" and be used for DDoS attacks, sending spam, etc. At the same time, the database is vulnerable to intrusion, sensitive information such as user privacy and commercial secrets may be stolen or tampered with, and website pages may be maliciously replaced, damaging the platform's reputation. In addition, the vulnerability may also become a springboard for attacking other systems, triggering chain security issues and posing multi-dimensional threats to servers, data and users.

# DESCRIPTION
Advanced Online Voting System, source code v1.0. After logging in, Upload new documents when adding content to a page,In the page /admin/candidates.php, the upload function in the /admin/candidates.php file was referenced, triggering an unlimited upload vulnerability. There are no restrictions or filters. Remote attackers can pass malicious loads through this file upload function, causing file uploads to be unrestricted and further leading to remote code execution (RCE).

# Vulnerability Details

## The process of vulnerability emergence

we should first add this position
<img width="2218" height="803" alt="Image" src="https://github.com/user-attachments/assets/29afcfc5-8560-47f3-aa74-6428523523d0" />

then to the target php, we upload the 1.php which have the One-liner Trojan
<img width="2190" height="900" alt="Image" src="https://github.com/user-attachments/assets/caf4971a-0a2a-487a-8408-0759033bbfa3" />

finally we can use our hackbar to hack it as the picture provided
<img width="2069" height="1274" alt="Image" src="https://github.com/user-attachments/assets/fe5ac366-47eb-40de-a5f1-50373eef667f" />

# Suggested repair
1.**Strictly validate uploaded files:**
Validate file types and extensions rigorously.
Verify MIME types on both client and server sides.
Perform content inspection to prevent disguised malicious files.

2.**Store uploaded files outside the web root:**
This prevents direct access and execution of uploaded files from the web.

3.**Apply strict file system permissions:**
Disable execution permissions on upload directories.
Ensure uploaded files cannot be directly executed.

4.**Use secure file upload libraries or frameworks:**
Leverage established libraries that offer secure file upload mechanisms.

• 来源: ⚠️ https://github.com/F1shDreAm/CVE/issues/3
• 用户: H1mm (UID 92686)
• 提交: 2025-11-17 14時03分 (11 月前)
• 管理: 2025-11-22 17時54分 (5 days later)
• 状态: 重复
• VulDB条目: 315090 [Campcodes Advanced Online Voting System 1.0 candidates_add.php photo 权限提升]
• 积分: 0