Description

A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T07:16:31.490Z",
  "pubdate": "2026-10-13T07:16:31.490Z",
  "executiveSummary": "The E-Learning System 1.0 is affected by an unrestricted file upload vulnerability located within the user management module. This security flaw originates from improper validation of the 'img' argument during the user profile saving process in the 'save_users' function.\nBy manipulating the upload process, a remote, unauthenticated or authenticated attacker can bypass file type restrictions to inject malicious executable code, such as web shells, into the server's filesystem.\nThe impact of this vulnerability is critical, potentially leading to Remote Code Execution (RCE), full system compromise, unauthorized data access, and persistent backdoor installation. Given the availability of public exploits, the risk to the application's integrity and confidentiality is severe.\nSuccessful exploitation requires the attacker to have network access to the application and the ability to interact with the vulnerable '/classes/Users.php?f=save' endpoint. Immediate remediation is required to prevent unauthorized system control.",
  "technicalDetails": "The vulnerability resides in the 'save_users' function within '/classes/Users.php', specifically in how the application handles the 'img' argument submitted via the user update interface. The root cause of this vulnerability is an absence of server-side validation concerning the file type, content, and extension of user-uploaded images.\nAn attacker can exploit this by crafting a malicious HTTP request that targets the '/classes/Users.php?f=save' endpoint. Instead of providing a legitimate image file, the attacker transmits a file containing malicious script code (e.g., a PHP web shell) disguised as or injected into the file upload parameter.\nThe server-side logic fails to verify the MIME type or the actual content of the file, allowing the malicious payload to be stored within the web-accessible directory. Because the system does not rename files to non-executable formats or validate the integrity of the uploaded data, the web server may process the uploaded file as a legitimate script if accessed directly.\nThe attack flow follows these steps: 1) The attacker initiates an HTTP request to the vulnerable endpoint. 2) The 'save_users' function receives the request and processes the 'img' parameter. 3) Due to the lack of strict filtering, the application writes the attacker-supplied malicious file to the server's filesystem. 4) The attacker navigates to the location of the uploaded file via the browser. 5) The server executes the malicious code, granting the attacker a command-line interface or remote control over the server environment.\nThis vulnerability is particularly dangerous as it allows for RCE under the context of the web server process. Once the attacker successfully executes the uploaded script, they can perform arbitrary actions, including reading sensitive configuration files, exfiltrating the database, modifying application logic, or pivoting further into the internal network. The lack of proper input sanitization and execution control allows for persistent malicious presence within the environment, independent of user authentication levels if the entry point is exposed without sufficient access controls."
}