EUVD-2026-33492
GHSA-55rv-vx3h-7mh7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Bdtask Multi-Store Inventory Management System 1.0. The affected element is the function Upload of the file application/modules/dashboard/controllers/Module.php of the component Component Module. The manipulation of the argument module results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Unrestricted file upload in Bdtask Multi-Store Inventory Management System 1.0 enables authenticated remote attackers to upload arbitrary file types - including PHP webshells - through the Component Module's Upload function, leading to potential remote code execution on the host server. The vulnerability resides in application/modules/dashboard/controllers/Module.php where the Upload function performs insufficient file type validation. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 6.3 score. No vendor patch has been identified at time of analysis.
Technical ContextAI
This is a CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerability in a PHP-based inventory management application. The affected component is the Module controller located at application/modules/dashboard/controllers/Module.php, specifically its Upload function, which handles file uploads for dashboard modules. In PHP applications, failure to validate file extensions or MIME types allows attackers to upload server-side executable scripts (e.g., .php webshells). Once uploaded, these files can be accessed via HTTP and executed by the web server, effectively granting arbitrary command execution. The CPE identifier cpe:2.3:a:bdtask:multi-store_inventory_management_system:*:*:*:*:*:*:*:* covers version 1.0 as the confirmed affected release. The application is a multi-tenant store and inventory platform, meaning compromise of the upload endpoint could affect all tenants hosted on the same instance.
RemediationAI
No vendor-released patch has been identified at time of analysis. Organizations running Bdtask Multi-Store Inventory Management System 1.0 should apply the following compensating controls immediately. First, restrict access to the dashboard's Component Module upload functionality to the minimum necessary administrator roles, reducing exposure from low-privilege account compromise. Second, implement server-side file extension and MIME type validation at the web application firewall or hosting layer to block upload of PHP and other executable file types - note this may break legitimate module upload workflows and should be tested before deployment. Third, configure the web server (Apache/Nginx) to deny execution of scripts in upload directories using location-block rules or .htaccess; this prevents uploaded webshells from being executed even if the upload succeeds, with no functional trade-off for static file serving. Fourth, monitor the upload directory for newly created PHP files as a detection control. Refer to https://vuldb.com/vuln/367429 for ongoing vendor patch status updates.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today