Description

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T07:16:54.400Z",
  "pubdate": "2026-08-24T07:16:54.400Z",
  "executiveSummary": "An unrestricted file upload vulnerability has been identified in itsourcecode Payroll System 1.0, specifically within the save_settings function located in admin_class.php. This security flaw enables remote attackers to upload arbitrary files to the server without adequate validation or sanitization of the img argument. Successful exploitation of this vulnerability can lead to severe system compromise, including potential remote code execution, unauthorized access to sensitive data, and complete system takeover. The vulnerability exposes the application to high risk, as the attack can be executed remotely by malicious actors over the network without requiring complex prerequisites. Given that exploit details have been publicly disclosed, the likelihood of automated scanning and active exploitation attempts targeting vulnerable deployments is significantly elevated. Organization deploying this software must implement immediate defensive measures to secure the application against unauthorized file uploads.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and file type enforcement within the save_settings function of admin_class.php in itsourcecode Payroll System 1.0. When processing requests involving the img argument, the application fails to adequately verify the extension, MIME type, and content of the uploaded file before storing it on the server filesystem. This lack of rigorous validation allows a remote attacker to bypass intended restrictions and upload malicious payloads, such as web shells or executable scripts, directly into web-accessible directories. The attack flow begins with the malicious actor crafting an HTTP request containing a multipart file upload, where the payload is supplied via the vulnerable img parameter. Upon submission, the server-side script processes the input and writes the file to disk without enforcing necessary security checks such as randomized file naming, strict allowlisting of permitted file extensions, or storage outside the web root. Once the malicious payload is successfully written to the server, the attacker can execute arbitrary code by directly accessing the uploaded file via the network using standard HTTP protocols. This capability facilitates full post-exploitation impact, including lateral movement, data exfiltration, and persistent access to the underlying operating system. The vulnerability affects version 1.0 of the software, requires network connectivity to the target application, and typically involves administrative or authenticated privileges depending on the access controls enforced by the surrounding application logic, though public exploits often target exposed administrative interfaces or bypass mechanisms."
}