Description

A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T07:16:31.290Z",
  "pubdate": "2026-10-13T07:16:31.290Z",
  "executiveSummary": "The Contact Tracing System version 1.0 is affected by an unrestricted file upload vulnerability located within the /classes/Users.php script.\nThis security flaw stems from insufficient validation of user-supplied input when processing file uploads, specifically targeting the img/id argument in the save function.\nAn unauthenticated or remote attacker can leverage this vulnerability to upload arbitrary files, including executable scripts, directly to the server's filesystem.\nSuccessful exploitation allows for remote code execution (RCE), potentially leading to a full system compromise, unauthorized data access, and persistent backdoors.\nThe vulnerability is currently subject to public disclosure, significantly increasing the risk of exploitation by threat actors targeting this application.\nImmediate remediation is required to restrict file types and enforce strict server-side validation protocols.",
  "technicalDetails": "The vulnerability resides in the /classes/Users.php file, specifically within the logic handling file movements via the move_uploaded_file function. The application fails to adequately sanitize or validate the file extension and MIME type of the uploaded content passed through the img/id argument.\nThe attack flow initiates when an attacker sends a crafted HTTP request targeting the /classes/Users.php?f=save endpoint. By manipulating the img/id parameter, the attacker can supply a malicious file—such as a PHP web shell—masquerading as an image or other innocuous file type. Because the backend move_uploaded_file function does not perform strict extension filtering or verify that the file content matches the expected file format, the server moves the malicious payload into a publicly accessible directory.\nOnce the file is successfully uploaded, the attacker can trigger the execution of the payload by sending a direct HTTP request to the location where the file was saved (e.g., /uploads/malicious_script.php). The web server interprets the uploaded script, granting the attacker arbitrary code execution capabilities under the context of the web server user.\nThis vulnerability is particularly dangerous because it bypasses conventional security assumptions regarding file uploads. The lack of an 'allow-list' approach for file extensions means the system blindly trusts the attacker's input. The attack requires no elevated privileges or prior authentication, facilitating remote exploitation over the network.\nPost-exploitation impact is severe, as the attacker can interact with the server's local file system, modify application databases, exfiltrate sensitive contact tracing data, or pivot to other systems within the internal network. The persistence of the uploaded malicious file ensures that the attacker retains access even if the application is restarted, unless the file is manually purged from the server."
}