Online Lot Reservation System CVE-2026-7134

Exploitation requires an active high-privilege authenticated session to the Online Lot Reservation System administrative interface - unauthenticated remote attackers cannot trigger this vulnerability (PR:H confirmed by CVSS 4.0 vector). The specific vulnerable code path is the image parameter submitted to /edithousepic.php, which handles house picture editing functionality; this endpoint must be accessible over HTTP/HTTPS from the attacker's location. For the most severe impact (arbitrary code execution), the web server must also permit PHP script execution within the upload destination directory - hardened deployments that disable PHP execution in upload directories limit impact to unauthorized file storage only. No special network conditions, protocols, or non-default OS configurations are otherwise required. Factors limiting exploitation: the authentication requirement (PR:H) means compromise of admin credentials is a prerequisite; and server-side execution restrictions on the upload path, if present, prevent code execution and reduce impact to Low across C/I/A.

The CVSS 4.0 score of 2.0 accurately reflects a constrained risk profile dominated by the PR:H (high-privilege authentication) requirement, which is the single most significant limiting factor. EPSS at 0.03% (10th percentile) confirms negligible automated or opportunistic exploitation probability, consistent with SSVC's Automatable=no determination. A public POC is confirmed on GitHub, elevating theoretical risk, but the authentication barrier prevents opportunistic mass exploitation. SSVC rates technical impact as only partial, and CVSS 4.0 impact metrics (VC:L/VI:L/VA:L with SC/SI/SA all N) indicate limited scope even on successful exploitation. There is a notable tension between CWE-434's typical association with critical RCE chains and the low CVSS score here - that gap is fully explained by PR:H. If the application's administrative credentials were compromised or default/weak credentials are in use, the effective risk escalates. No CISA KEV listing confirms no known active exploitation campaigns. The primary concern is defenders who may deprioritize this due to low CVSS score while overlooking that file upload vulnerabilities can chain to full server compromise if upload-directory execution controls are absent.

An attacker who has obtained administrative credentials - through credential stuffing, phishing, or reuse of a default password - authenticates to the Online Lot Reservation System and navigates to the house picture editing page backed by /edithousepic.php. A public POC on GitHub (https://github.com/zzk6th/cve/issues/4) demonstrates uploading a PHP webshell (e.g., a file named shell.php or shell.php.jpg with PHP code) via the image parameter, bypassing server-side validation. If the upload destination directory lacks execution restrictions, the attacker then issues an HTTP GET request to the uploaded file's URL, achieving server-side command execution under the web server's process account.