EUVD-2026-41723
GHSA-c4r3-97x9-r646
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible PHP upload endpoint; low-privilege auth required per CVSS 4.0; scope changes because uploaded webshell executes server-side, yielding full RCE impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. Impacted is an unknown function of the file upload_files.php. Performing a manipulation results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Unrestricted file upload in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0 allows low-privileged remote attackers to upload arbitrary file types via the upload_files.php endpoint, with potential for remote code execution through PHP webshell deployment given the application's PHP runtime environment. The vulnerability is rooted in CWE-434 and carries a network-accessible attack vector with no special configuration required beyond a valid user account. A public proof-of-concept exploit is confirmed available on Pastebin; no CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The affected application is a PHP-based learning management system distributed by SourceCodester, a provider of freely available educational source code projects typically used for academic and demonstration purposes. The vulnerable component is upload_files.php, which fails to validate or restrict the types of files that authenticated users may upload - the root cause class is CWE-434 (Unrestricted Upload of File with Dangerous Type). In PHP web applications, this class of flaw is particularly consequential because the web server typically executes any .php (or .phtml, .php5, etc.) files uploaded to web-accessible directories as server-side code, enabling an attacker to deploy a webshell and achieve arbitrary OS command execution. The affected CPE is cpe:2.3:a:sourcecodester:syllabus-aligned_learning_management_and_examination_system:*:*:*:*:*:*:*:*, covering version 1.0 as disclosed. No patched-version CPE is identified in the available data.
RemediationAI
No vendor-released patch has been identified at time of analysis. This application is distributed as educational open-source PHP code by SourceCodester, and no security advisory or patched release has been published through any tracked reference. The most effective immediate compensating control is to remove or disable the upload_files.php endpoint entirely if the upload feature is non-essential - this eliminates the vulnerable attack surface with no side effects for most minimal deployments. If file upload functionality is operationally required, restrict endpoint access to the minimum necessary authenticated roles via application-layer controls and implement strict server-side file type validation using an allowlist of safe extensions and MIME types, explicitly rejecting .php, .phtml, .php5, .phar, and similar executable types. Critically, configure the web server to deny PHP execution within the upload storage directory (e.g., via an Apache .htaccess directive such as 'php_flag engine off' or an Nginx location block with 'deny all' for PHP files in the uploads path) - this limits damage even if a malicious file is successfully uploaded. The VulDB advisory at https://vuldb.com/vuln/376294 and the public proof-of-concept at https://pastebin.com/PNJvBZwT should be reviewed for technical detail. Given the absence of an active maintenance track, organizations should evaluate replacing this application with a supported LMS platform.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today