| 标题 | Student-Management-System imranrisal-dev 1/1 Command Injection |
|---|
| 描述 | Vulnerability Title: Arbitrary File Upload Leading to Remote Code Execution (RCE)
Description:
The application is vulnerable to arbitrary file upload in both student and staff profile picture modules (student_profile_pic.php and staff_profile_pic.php). The system extracts the original filename from the $_FILES['choose_file'] parameter and uses it directly to construct the destination path within the publicly accessible /asset/upload/ directory.
The application lacks essential security controls, including file extension white-listing, MIME type validation, file content/header inspection, and filename randomization. An authenticated attacker can upload a malicious script (e.g., .php file) and subsequently execute it by accessing the file URL directly via the web server. This leads to arbitrary code execution on the underlying server with the privileges of the web application user. |
|---|
| 来源 | ⚠️ https://github.com/sanjibsajid381-ctrl/My-Web-cve/issues/1 |
|---|
| 用户 | HackEight (UID 99045) |
|---|
| 提交 | 2026-06-16 15時45分 (2 月前) |
|---|
| 管理 | 2026-08-05 11時55分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 386147 [imranrisal-dev Student-Management-System Shared Upload Helper student_profile_pic.php storeProfileImage choose_file 权限提升] |
|---|
| 积分 | 20 |
|---|