SourceCodester E-Learning System EUVD-2026-98314

Requires network reachability to the application's /classes/Users.php?f=save endpoint and that the save_users handler accept the 'img' parameter without enforcing file-type, extension, or content validation, plus the ability to subsequently request files from the upload directory where PHP execution is permitted. The input vector marks this PR:N (unauthenticated); however, save_users is typically an administrative user-management action, so whether it is genuinely reachable pre-authentication in a default install is not confirmed from the provided data and should be verified - if a session/admin role is actually required, realistic risk drops substantially. No user interaction is needed (UI:N), and version 1.0 is the stated affected build.

The input CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 (medium) and describes a remote, unauthenticated, low-complexity attack against an exposed PHP endpoint - attributes that normally raise priority. However, the same vector rates impact as only Low across confidentiality, integrity and availability (VC:L/VI:L/VA:L), which directly conflicts with the vulnerability class: CWE-434 unrestricted file upload in a PHP application typically permits uploading an executable webshell, yielding full remote code execution - an outcome the linked exploit reference explicitly markets as 'preauth-rce'. This impact rating should be treated as understated; verify against the actual upload handler. On the exploitation side, the only threat signal present is E:P (Proof-of-Concept) in the 4.0 vector, corroborated by a publicly available exploit; there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. A full SSVC decision cannot be computed - exploitation status is at most 'PoC', automatable is unknown, and technical impact is disputed. Net assessment: this is a technically serious flaw (likely RCE) with a public exploit, but its REAL-WORLD priority is low because the affected product is an obscure, tiny-footprint tutorial application rather than widely deployed enterprise software. Treat as patch-if-present rather than emergency.

A remote attacker sends a crafted multipart HTTP POST to /classes/Users.php?f=save, supplying a malicious PHP file in the 'img' parameter that the save_users function stores without validating file type or extension. The attacker then requests the uploaded file directly to execute it as a webshell, gaining command execution on the server. A public exploit is already available (referenced as a pre-auth RCE release), lowering the skill required to reproduce the attack.