Description

A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function move_uploaded_file of the file admin/add_admin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-13T07:16:31.680Z",
  "pubdate": "2026-10-13T07:16:31.680Z",
  "executiveSummary": "A critical unrestricted file upload vulnerability has been identified in SourceCodester Library Management System 1.0. The vulnerability resides within the admin/add_admin.php script, specifically in how the application handles the image parameter during administrative account management. By manipulating this argument, an attacker can bypass intended file validation mechanisms and upload arbitrary files to the server.\nThis flaw allows for remote code execution (RCE) if an attacker uploads a malicious script, such as a PHP web shell, into a directory accessible by the web server. The risk is considered high, as the vulnerability is publicly documented, increasing the likelihood of exploitation by threat actors. Successful exploitation allows an attacker to gain unauthorized control over the server, potentially leading to full system compromise, data theft, and persistence within the network. No specific authentication constraints are mentioned in the flaw's initiation, and the attack can be launched remotely over a network.",
  "technicalDetails": "The vulnerability is caused by improper input validation within the admin/add_admin.php file of the Library Management System 1.0. Specifically, the application utilizes the move_uploaded_file function to store files submitted through the image argument without performing adequate server-side validation on the file's extension, MIME type, or content integrity.\nThe attack flow proceeds as follows: An attacker identifies the target endpoint, which expects an image file for an administrative profile. The attacker crafts a multipart/form-data request, replacing the expected image file with a malicious payload, typically a PHP script designed to execute system commands or provide remote shell access. Because the application fails to verify the nature of the uploaded content before invoking move_uploaded_file, it blindly moves the malicious file into a directory within the web root.\nUpon successful upload, the attacker can then navigate directly to the path where the file was stored. When the web server processes the request for this file, it interprets and executes the embedded PHP code. This interaction bypasses standard security controls and allows the attacker to execute arbitrary code within the context of the web server process.\nThe exploitation is facilitated by the lack of whitelist-based file extension filtering or content-disposition validation. The vulnerability is publicly disclosed, meaning that automated scanners or exploit scripts are likely already being utilized to identify vulnerable instances. The post-exploitation impact includes full control over the application's environment, the ability to read or modify sensitive database records containing user credentials, potential lateral movement within the hosting infrastructure, and the installation of persistent backdoors to ensure ongoing unauthorized access."
}