EUVD-2026-41791
GHSA-6pv2-9j3w-5x6g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege authentication required (PR:L); no special conditions needed (AC:L); webshell upload achieves full server compromise with scope change (S:C, C/I/A:H).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is the function pathinfo of the file /upload_files.php of the component Filename Extension. Performing a manipulation results in unrestricted upload. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The name of the affected product appears to have a typo in it.
AnalysisAI
Unrestricted file upload in SourceCodester Onlne Examination & Learning Management System 1.0 (a PHP-based web application whose product name contains a documented typo - 'Onlne' rather than 'Online') permits remote low-privileged authenticated users to upload arbitrary files, including PHP webshells, via the /upload_files.php endpoint by exploiting inadequate extension validation in the pathinfo() function. Publicly available exploit code exists on GitHub, with the exploit document explicitly titled to reference remote code execution against this specific upload handler. No vendor-released patch has been identified, and the vulnerability is not listed in the CISA KEV catalog, though the public exploit materially lowers the barrier to exploitation.
Technical ContextAI
The affected application is a PHP web application (CPE: cpe:2.3:a:sourcecodester:onlne_examination_&_learning_management_system:*:*:*:*:*:*:*:*) distributed freely by SourceCodester, a code-sharing platform targeting students and developers. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), arising from the misuse of PHP's pathinfo() function as the sole or primary mechanism for filename extension validation in /upload_files.php. The pathinfo() function returns components of a file path (dirname, basename, extension, filename) and is commonly misused when developers check only one component - for example, checking the extension of 'shell.php.jpg' may return '.jpg' depending on which pathinfo() key is evaluated, allowing an attacker to upload a valid PHP-executable file under a name that passes the check. In PHP environments, a successfully uploaded webshell immediately enables arbitrary server-side command execution at the privilege level of the web server process.
RemediationAI
No vendor-released patch has been identified at time of analysis - SourceCodester does not issue formal security advisories or patched releases for its freely distributed code samples, making upstream remediation unlikely. The most direct mitigation is to disable or block access to /upload_files.php entirely if file upload functionality is non-essential, eliminating the attack surface with no side effects beyond loss of upload capability. If uploads are operationally required, replace the pathinfo()-based extension check with strict server-side MIME type inspection using PHP's finfo_file() function, enforce an explicit allowlist of safe extensions (e.g., .pdf, .png, .jpg only), rename all uploaded files server-side using a server-generated UUID to strip attacker-controlled extensions, and store uploaded files in a directory outside the web root or configured as non-executable by the web server. Deploying a Web Application Firewall rule to block multipart uploads of .php, .phtml, .phar, and similar executable extensions provides an additional compensating layer, though WAF bypass is possible against misconfigured handlers. Organizations running this application on internet-accessible infrastructure should assess whether replacement with a supported, actively maintained LMS is feasible. The VulDB advisory is at https://vuldb.com/vuln/376366 and the public exploit documentation is at https://github.com/nuiifornet/A033/blob/main/OE-LMS-RCE-2-upload_files.md.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today