Executive Summary

CVE-2026-10172 is a Remote Code Execution (RCE) vulnerability in the Bdtask Multi-Store Inventory Management System version 1.0. The flaw exists in the module upload feature, where an authenticated admin can upload a malicious ZIP archive containing a PHP file.

The application extracts the archive into the application/modules/ directory and then includes an attacker-controlled PHP file (config/config.php) without proper validation. This leads to arbitrary PHP code execution on the server whenever the Add Module page is loaded.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious uploads of ZIP archives to the module upload feature by authenticated admin users. Specifically, look for uploads that result in the extraction of files into the application/modules/ directory, especially if they include PHP files such as config/config.php.

You can also check for unexpected PHP files in the application/modules/ directory or unusual HTTP requests to the Add Module page that might trigger the inclusion of attacker-controlled PHP files.

• Use web server logs to identify POST requests to the module upload endpoint.
• Run commands to find recently added or modified PHP files in the application/modules/ directory, for example: find /path/to/application/modules/ -name '*.php' -mtime -7
• Use grep to search for suspicious PHP code or webshell signatures in the modules directory: grep -r 'eval(' /path/to/application/modules/

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the module upload feature to only fully trusted administrators and monitoring or disabling the upload functionality if possible.

Validate and sanitize all uploaded files to prevent malicious archives from being extracted and executed.

Remove any suspicious or unauthorized PHP files found in the application/modules/ directory.

Apply any available patches or updates from the vendor as soon as they are released.

Monitor logs for unusual activity related to module uploads and the Add Module page.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can execute arbitrary operating system commands on the server, read or modify files, or establish a persistent backdoor.

This can lead to full compromise of the affected system, unauthorized access to sensitive data, and potential disruption of services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated admin to upload malicious code leading to remote code execution, which can result in unauthorized access, modification, or disclosure of sensitive data.

Such unauthorized access and potential data breaches can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring system integrity.

Exploitation of this vulnerability could lead to violations of confidentiality, integrity, and availability requirements mandated by these standards.

Useful 0 Not Useful 0