Vehicle Management System CVE-2026-11344

The vulnerable code-projects Vehicle Management System 1.0 instance must be deployed with newdriver.php (the New Driver Registration Form) reachable over the network, and the upload directory must permit PHP execution by the web server - which is the default for typical LAMP/XAMPP deployments this sample app targets. No authentication, no user interaction, and no special configuration toggles are required (CVSS PR:N/UI:N/AC:L). Exploitation is limited to instances of this specific code-projects product at version 1.0; environments that already restrict execution in upload directories or front the app with an upload-filtering WAF reduce but do not eliminate exposure.

CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction - favorable conditions for attackers. The C:L/I:L/A:L impact metrics yield a base score of 7.3, but the GitHub exploit explicitly claims Unauthenticated Remote Code Execution, which suggests the true impact (full server compromise) is materially higher than the partial-impact CVSS rating reflects. The publicly available PoC and PR:N raise practical risk, though no EPSS score, KEV listing, or evidence of mass exploitation was provided; the product is a small open-source/sample PHP project with limited enterprise deployment, so exploitation will likely be opportunistic against exposed instances rather than widespread. Confidence is reduced by the absence of a vendor advisory and a tagged patched release.

An unauthenticated attacker browses to the public-facing /newdriver.php registration form and submits a crafted multipart POST request supplying a PHP webshell (e.g., shell.php) in the photo field. The server writes the file into the uploads directory; the attacker then requests the uploaded path directly, executing arbitrary commands as the web server user and pivoting to data theft or full host takeover. A working exploit is published at the referenced GitHub repository, lowering the skill barrier substantially.