EUVD-2026-41790
GHSA-g9x9-wg38-wjf3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-434 in PHP enables webshell upload and RCE with scope change (S:C), requiring only a low-privilege account (PR:L) reachable over the network; no authentication complexity or special conditions apply.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in SourceCodester Onlne Examination & Learning Management System 1.0. Affected is an unknown function of the file /process_lesson.php. Such manipulation of the argument user_id leads to unrestricted upload. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the affected product appears to have a typo in it.
AnalysisAI
Unrestricted file upload in SourceCodester Onlne Examination & Learning Management System 1.0 allows network-accessible, low-privilege attackers to upload arbitrary file types - including executable PHP webshells - via the user_id parameter in /process_lesson.php, with the publicly available proof-of-concept explicitly framed as a remote code execution chain. No CISA KEV listing exists, but a working exploit is publicly available on GitHub under the title 'OE-LMS-RCE-1'. The assigned CVSS 4.0 score of 2.1 with low-impact metrics materially understates the realistic impact; CWE-434 in PHP environments routinely enables full server compromise when uploads land in web-executable directories.
Technical ContextAI
CWE-434 (Unrestricted Upload of File with Dangerous Type) manifests in the PHP endpoint /process_lesson.php, which processes lesson submissions and fails to validate or restrict the file types submitted alongside the user_id parameter. In PHP web applications, this flaw class is particularly dangerous: if an attacker uploads a .php or .phar file to a web-accessible directory, the server-side PHP interpreter will execute it upon retrieval via HTTP, enabling arbitrary OS-level command execution under the web server process. The CPE string cpe:2.3:a:sourcecodester:onlne_examination_&_learning_management_system:*:*:*:*:*:*:*:* identifies the product with the vendor-confirmed typo 'Onlne' (rather than 'Online') and uses a wildcard version field, indicating only version 1.0 is currently documented but potentially all versions are affected. SourceCodester distributes free PHP-based open-source scripts primarily for educational and student use.
RemediationAI
No vendor-released patch has been identified at time of analysis for SourceCodester Onlne Examination & Learning Management System 1.0; the VulDB advisory at https://vuldb.com/?id.376365 should be monitored for any future patch release. As compensating controls, administrators should immediately implement server-side file type validation in /process_lesson.php - whitelist only permitted extensions (e.g., PDF, DOCX) and validate MIME type against file content, rejecting .php, .phtml, .phar, and similar executable types. Uploaded files should be stored outside the web root entirely, or placed in a directory with PHP execution disabled via .htaccess (php_flag engine off) to prevent webshell execution even if a malicious file is uploaded - note this may break legitimate lesson file delivery workflows and require a redesigned serving mechanism. Access to /process_lesson.php should be restricted at the web server layer to authenticated sessions. Given the absence of a patch and the low-maturity nature of SourceCodester products, organizations should evaluate whether continued production use of this application is justified.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today