Payroll System CVE-2026-78202

The vulnerable code path is the save_settings function in admin_class.php, triggered via the img file upload parameter. The provided CVSS 4.0 vector asserts PR:N (no privileges required), which would mean the endpoint is reachable without authentication - however, this conflicts with the admin_class.php naming convention, which typically implies an active admin session. This discrepancy is unresolved from available data and should be independently verified by inspecting the application's session checks before the save_settings call. Exploitation also requires that the web server be configured to execute PHP files in the upload destination directory - if the upload path is outside the web root or PHP execution is disabled there, webshell execution is blocked even if upload succeeds. No special non-default configuration is described beyond the application running on a PHP-enabled web server with a writable upload directory.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the E:P exploitation tag (POC publicly available) paint a concerning picture: zero barriers to network exploitation, no user interaction required, and functional exploit code already public. However, the impact metrics (VC:L/VI:L/VA:L) appear conservative for an unrestricted PHP file upload - if a webshell can be uploaded and executed, confidentiality, integrity, and availability impacts should realistically be High, not Low, suggesting the CVSS scoring may reflect limited upload directory access or some server-side restriction not described in the advisory. The PR:N rating conflicts with the admin_class.php context, which typically implies an authenticated admin session; this discrepancy should be verified with the vendor or by reviewing the source. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, meaning active exploitation is not confirmed - though POC availability substantially lowers the effort required for opportunistic attackers. Given that itsourcecode scripts are widely cloned and deployed without hardening, even small deployments represent low-hanging fruit for automated scanning and exploitation tools.

An attacker sends a crafted HTTP multipart POST request to admin_class.php targeting the save_settings function, supplying a PHP webshell (e.g., <?php system($_GET['cmd']); ?>) as the img file parameter. If the server saves the file to a web-accessible directory without extension validation, the attacker issues a second GET request to the uploaded file's URL, passing OS commands via the query string. A public proof-of-concept demonstrating this sequence is available at the GitHub reference linked in the advisory.