Description

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Such manipulation of the argument img[]/imgName[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-07T16:17:24.113Z",
  "pubdate": "2026-08-07T16:17:24.113Z",
  "executiveSummary": "An unrestricted file upload vulnerability has been identified within SourceCodester Photo Share Website 1.0, specifically in the file handling routine located at /social/ajax.php?action=save_upload.\nThis security flaw allows remote, unauthenticated, or low-privileged attackers to upload arbitrary files to the underlying web server by manipulating the img[] or imgName[] input parameters.\nSuccessful exploitation of this vulnerability can lead to remote code execution (RCE) if the uploaded payloads, such as malicious web scripts, are successfully stored within the web-accessible directory and subsequently executed by the server.\nThe risk implication is critical, as complete compromise of the affected web application and underlying server environment is achievable.\nThe attack can be executed remotely over the network without requiring complex preconditions beyond network accessibility to the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides in the backend processing script accessed via the URI /social/ajax.php with the action parameter set to save_upload within SourceCodester Photo Share Website 1.0.\nThe root cause of the vulnerability is the absence of adequate input validation, file type verification, and extension whitelisting mechanisms on the server-side when handling multi-part or array-based file uploads processed through the img[] and imgName[] parameters.\nDuring the attack flow, a malicious actor crafts a specialized HTTP request targeting the vulnerable AJAX endpoint, supplying a file designed to bypass superficial client-side checks.\nThe attacker embeds malicious payloads, such as web shell scripts disguised as benign image formats or utilizing double extensions, within the vulnerable file upload vectors.\nDue to insufficient sanitization and validation of the uploaded file's extension and content type, the server accepts the payload and writes it directly to the file system within the web root or an accessible upload directory.\nOnce the file is successfully written to the server, the attacker can issue subsequent direct HTTP requests to the stored file location, triggering execution of the embedded script within the context of the web server user.\nThe component involved is the file upload handler processing the save_upload action in /social/ajax.php.\nAffected versions are limited to SourceCodester Photo Share Website 1.0.\nNetwork exposure is direct, as the endpoint is accessible over HTTP/HTTPS remotely.\nPost-exploitation impact includes arbitrary file read and write capabilities, potential remote code execution, system enumeration, and complete server takeover depending on the privileges of the web application process."
}