Description

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-24T11:16:41.040Z",
  "pubdate": "2026-08-24T11:16:41.040Z",
  "executiveSummary": "A critical unrestricted file upload vulnerability has been identified within itsourcecode Online Pharmacy System 1.0. This security defect resides in the User Registration component, specifically within the file all_users/register.php, affecting the move_uploaded_file function. The flaw allows remote unauthenticated attackers to bypass security mechanisms and upload arbitrary files, such as malicious web shells, directly to the hosting server. Successful exploitation of this vulnerability leads to remote code execution, full system compromise, and potential data exfiltration. The risk is significantly elevated due to the public availability of an exploit. Remediation requires rigorous input validation, strict file extension whitelisting, and secure storage configurations for all user-supplied files.",
  "technicalDetails": "The vulnerability is caused by improper validation and handling of user-supplied file uploads within the User Registration component of itsourcecode Online Pharmacy System 1.0. Specifically, the script located at all_users/register.php processes incoming registration requests that include an argument named photo. The underlying code passes this argument directly to the PHP function move_uploaded_file without enforcing adequate restrictions on the file type, extension, size, or content.\nAttackers can leverage this flaw remotely without requiring authentication or specific administrative privileges. The exploitation flow begins when an attacker crafts a malicious HTTP POST request targeting all_users/register.php. Within this multipart/form-data request, the attacker supplies a malicious payload—such as a PHP web shell—disguised as an image or uploaded directly through the photo parameter. Because the application fails to validate the file extension against a strict whitelist or verify the true MIME type, the server accepts the file.\nUpon receiving the upload, the application invokes move_uploaded_file, which writes the attacker-controlled file to a publicly accessible directory on the web server. Once the payload is successfully written to disk, the attacker can execute arbitrary system commands by issuing a direct HTTP request to the newly uploaded file path. This results in post-exploitation scenarios including complete system takeover, unauthorized access to sensitive pharmacy database records, defacement, and pivoting to internal network segments."
}