EUVD-2026-24139
GHSA-3pw2-2fp4-54wm
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an authenticated admin to upload a PHP webshell and achieve Remote Code Execution on the server.
AnalysisAI
Remote code execution in Visitor Management System 1.0 allows authenticated administrators to upload PHP webshells via two unvalidated file upload endpoints (admin_user_insert.php and update_1.php). The move_uploaded_file() function lacks MIME type, extension, and content validation, enabling direct server compromise. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running Visitor Management System 1.0 and document current versions; restrict administrative access to admin_user_insert.php and update_1.php endpoints via network firewall or WAF rules blocking POST/file uploads. Within 7 days: Conduct forensic audit of file upload directories and admin logs for unauthorized PHP files or suspicious administrative activity dating back 90 days; isolate affected systems from production networks if compromise indicators are found. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today