Online Job Portal CVE-2026-15677

The /JobSeekerInsert.php endpoint must be publicly reachable over the network. No authentication is required - the endpoint is intended for unauthenticated job seeker registration (PR:N per CVSS 4.0 vector). No special configuration is needed; this is a default behavior of version 1.0 as shipped. Exploitation success additionally requires: (1) the web server must execute PHP files in the upload destination directory - if uploads are stored outside the web root or PHP execution is disabled for the upload path, webshell invocation is blocked; (2) the server must be running a PHP-capable web server (e.g., Apache, nginx with PHP-FPM). The primary limiting factor is deployment footprint - this is a niche educational/demo PHP application with a small real-world install base.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-accessible, zero-complexity, unauthenticated exploitation with no user interaction required - maximum accessibility for a remote flaw. The exploit maturity modifier E:P confirms a publicly available proof-of-concept, reducing attacker skill requirements. However, the base impact metrics VC:L/VI:L/VA:L appear to significantly understate realistic risk: CWE-434 on a PHP application typically leads to webshell deployment and full server compromise, not merely low-level impact. This discrepancy between the CVSS 4.0 score (6.9) and the underlying vulnerability class warrants independent assessment. The product is not in CISA KEV, so active exploitation is not independently confirmed at time of analysis. No EPSS data was provided. Despite the moderate CVSS score, the combination of unauthenticated network access, public POC, and the nature of unrestricted upload on a PHP platform makes this a high-priority remediation target for any exposed deployment.

An unauthenticated attacker sends a crafted HTTP POST request to /JobSeekerInsert.php with a PHP webshell (e.g., <?php system($_GET['cmd']); ?>) supplied as the txtFile parameter value. The server stores the file without validating its type, and the attacker then issues a GET request to the uploaded file's web-accessible path with an OS command in the query string, achieving arbitrary command execution as the web server user. A public proof-of-concept is available at https://github.com/shihuizhang-dazhi/MY-CVE/issues/6, confirming the technique is documented and accessible to low-skill attackers.