Unrestricted File Upload RCE in upload_save.php and teacher_avatar.php

Vulnerability Overview Title: Unrestricted File Upload in and Leading to Remote Code Execution #6 Summary: Two upload endpoints of the application accept arbitrary file types (one blocks only , while the other blocks none) and store the files with their original filenames in the server-side directory. Teacher accounts (which any anonymous user can obtain via login SQL injection) can therefore upload a PHP Webshell by requesting their URLs and execute it. Affected Versions: Commit Hash: Vulnerability Type: Unrestricted Critical Type File Upload (Remote Code Execution) Affected Code: File: , Root Cause: uses a blacklist for only one extension ( ) and a client-provided MIME type: , , , and other executable extensions are allowed through, and the MIME type is controlled by the attacker. performs no type checking on the result of , which is assigned to a variable and discarded. In both cases, the target directory is within the document root, and the files contain executable extensions, causing the web server to execute them. The only session requirement is , which can be obtained anonymously via login SQL injection. Impact Scope Remote Code Execution: Execution of arbitrary code as the web server user ( ) on the server hosting the application; reading arbitrary files, modifying application data, and pivoting data to the internal network. Upload Requires Only Teacher Session: Teacher sessions can be obtained anonymously via login SQL injection (CVE-01) or account takeover via registration (CVE-03), making the effective attack chain entirely unauthenticated. Uploaded File Persistence: Uploaded files are stored in ; database rows created by also expose the file path to each student. Remediation Restrict File Types: Implement stricter whitelist checks for uploaded file types, rather than relying solely on blacklists. Validate MIME Types: Ensure the MIME type matches the actual file content to prevent attackers from forging MIME types. Inspect File Content: Perform further validation on the content of uploaded files to ensure they do not contain malicious code. Restrict Upload Directory: Store uploaded files outside the document root to prevent direct access and execution. Session Management: Strengthen session management to prevent session acquisition via SQL injection. POC Code CVSS CVSS v3.1 Base Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Calculation: Exploitability = 8.22 × 0.85 × 0.77 × 0.62 (PR:L) × 0.85 = 2.84; Impact = 6.42 × [1 - (1-0.56)^3] = 5.87; Base = round(2.84 + 5.87) = 8.8 Reasoning: Teacher-level upload allows execution of arbitrary PHP as the web server user (complete CIA impact in both application and host contexts). The PR:L requirement is nominal; teacher sessions can be obtained anonymously via login SQL injection (CVE-01) or account takeover via registration (CVE-03), rendering the effective attack chain unauthenticated.

Goal Reached Thanks to every supporter — we hit 100%!

Unrestricted File Upload RCE in upload_save.php and teacher_avatar.php

More from this source