Unrestricted File Upload to RCE in Online Examination & Learning Management System v1.0

Vulnerability Overview Vulnerability Name: Online Examination & Learning Management System Unrestricted File Upload → Remote Code Execution Affected Product: Online Examination & Learning Management System Affected Version: v1.0 Vulnerability Type: Unrestricted File Upload → Remote Code Execution Root Cause: The file allows clerks and super admins to publish announcements with file attachments. Uploaded files use to prevent path traversal, but there is no validation of file extensions, MIME types, or file contents. The UI label "ATTACH_DOCUMENT (PDF/JPG)" is purely decorative; no checks are performed on the server side. Authorization gating at line 8 restricts POST uploads to and roles via . Impact Scope An attacker with clerk-level access can upload a PHP webshell and execute commands such as . Requires a clerk account. A default clerk account exists in the database with a predictable password ( ). Vulnerability Details and POC Vulnerability Endpoint: Prerequisites: Clerk or super_admin session Default clerk account present in the database with a predictable password PoC 1: Login + Upload Webshell as Clerk Response: HTTP 200 — The page contains "SUCCESS: BROADCAST_DEPLOYED". PoC 2: Execute Command PoC 3: One-Liner Full Exploit Chain Suggested Remediation 1. Add Extension Whitelist: 2. Validate MIME Type using on the temporary file before calling . 3. Disable PHP Execution in the Upload Directory — achievable via or by moving the directory outside the web root. 4. Strip Original Extensions — Store files with a extension or use content-hash-based filenames without extensions. Proof of Concept Evidence

Goal Reached Thanks to every supporter — we hit 100%!

Unrestricted File Upload to RCE in Online Examination & Learning Management System v1.0

More from this source