Arbitrary File Upload Vulnerability in SourceCodester Simple Company Website V1.0 with POC

Critical Vulnerability Information Affected Product SourceCodester Simple Company Website with an Admin Panel Project V1.0 Vulnerability Type Arbitrary File Upload Affected Versions V1.0 Vulnerable File /classes/Users.php Root Cause The function in the file contains an arbitrary file upload vulnerability. Attackers can upload malicious PHP scripts disguised as image files. Impact Attackers can exploit this vulnerability by uploading malicious PHP scripts to the server, potentially leading to remote code execution, system compromise, data leakage, and denial-of-service attacks. Vulnerability Description This vulnerability allows attackers to upload malicious PHP scripts to the affected SourceCodester Simple Company Website with an Admin Panel application. Attackers bypass file extension checks by disguising malicious scripts as image files, successfully uploading them to the server, thereby gaining full control over the compromised system. Authentication Requirements Default admin credentials for the system: - admin/123456789 Vulnerability Parameter img (multipart/form-data type) POC Payload Exploitation Verification After successfully uploading the malicious file, it can be accessed in the directory under the web root. Recommended Remediation Measures 1. Enforce strict file type and extension validation. 2. Prohibit execution of uploaded files in critical directories. 3. Restrict and control file uploads. 4. Implement Content Security Policy (CSP). 5. Use secure input validation and sanitization. 6. Monitor and log suspicious upload activities. 7. Conduct regular security audits and code reviews.

Goal Reached Thanks to every supporter — we hit 100%!

Arbitrary File Upload Vulnerability in SourceCodester Simple Company Website V1.0 with POC

More from this source