Description

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-15T07:16:33.830Z",
  "pubdate": "2026-09-15T07:16:33.830Z",
  "executiveSummary": "A critical Unrestricted File Upload vulnerability exists in the Profile Picture Upload component of SourceCodester Online Faculty Clearance System 1.0.\nThe vulnerability originates from the insecure implementation of the move_uploaded_file function within the file production/edit_picture.php.\nBy manipulating the file upload parameters, a remote attacker can bypass existing security controls to upload arbitrary files, including malicious scripts, directly to the web server.\nSuccessful exploitation permits remote code execution, potentially leading to a full system compromise, unauthorized data access, and persistent server-side modification.\nThe risk is high due to the exploit being publicly available, which simplifies the attack vector for unauthorized actors.\nThe attack is executable remotely and does not require physical access to the server infrastructure.",
  "technicalDetails": "The vulnerability is situated within the production/edit_picture.php file, which handles user-provided image uploads for profile customization.\nThe root cause is the lack of server-side validation regarding the file extension, MIME type, or content integrity of the uploaded data before passing the file handle to the move_uploaded_file function.\nThe move_uploaded_file function is designed to move an uploaded file to a new destination; however, in this implementation, it fails to verify if the file being saved is a legitimate image file or a malicious executable (such as a .php, .phtml, or .php5 script).\nAn attacker can exploit this by intercepting the HTTP POST request during the upload process and modifying the filename or the binary content to include malicious code.\nThe attack flow follows these steps: First, the attacker navigates to the profile management interface and initiates a file upload request. Second, the attacker uses a proxy tool to intercept the request and inject a web shell disguised as an image file. Third, because the server lacks adequate filtering, the application saves the malicious file into a directory accessible by the web server. Finally, the attacker triggers the execution of the payload by requesting the uploaded file URL, resulting in remote code execution (RCE) with the privileges of the web server process (e.g., www-data).\nBecause the application does not enforce randomization of filenames or restrict uploads to specific allowed directories, the attacker maintains predictable access to the uploaded script.\nThe post-exploitation impact includes the ability to execute arbitrary commands, manipulate the underlying database of the Online Faculty Clearance System 1.0, exfiltrate sensitive faculty information, or deploy secondary payloads to establish persistence within the hosting environment."
}