Unrestricted File Upload in Online Examination & Learning Management System

Compliance Impact

The vulnerability allows unrestricted file upload leading to remote code execution, which can compromise the confidentiality, integrity, and availability of data within the Online Examination & Learning Management System.

Such a compromise could lead to unauthorized access to sensitive personal data, potentially violating data protection regulations like GDPR and HIPAA that require strict controls over data security and breach prevention.

Failure to properly validate uploaded files and prevent remote code execution increases the risk of data breaches, which can result in non-compliance with these standards and lead to legal and financial penalties.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-14777 is an unrestricted file upload vulnerability in the Online Examination & Learning Management System, specifically in the announcements.php file.

Users with clerk or super_admin roles can upload files without proper validation. Although the system tries to prevent path traversal using basename(), it does not check file extensions, MIME types, or file content.

The user interface suggests only PDF or JPG files are allowed, but the server does not enforce this restriction.

An attacker with clerk-level access can upload a malicious PHP webshell, which allows them to execute commands on the server as the www-data user, leading to remote code execution.

The vulnerability can be exploited by sending a POST request to /announcements.php with a malicious PHP file attached.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with limited privileges (clerk-level access) to upload and execute malicious code on the server.

Successful exploitation can lead to remote code execution, which means the attacker can run arbitrary commands on the server.

This can result in unauthorized access, data theft, data manipulation, service disruption, or complete system compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the /announcements.php endpoint allows unrestricted file uploads without proper validation of file extensions or MIME types.

One way to test this is by sending a POST request to /announcements.php with a malicious PHP file attachment and observing if it gets uploaded and executed.

For example, you can use the following curl command to attempt uploading a PHP webshell:

• curl -X POST -F "[email protected]" http://target/announcements.php

After uploading, try to access the uploaded PHP file to verify if remote code execution is possible.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Implement an extension whitelist to allow only safe file types (e.g., PDF, JPG).
• Validate MIME types and file content on the server side to prevent malicious uploads.
• Disable PHP execution in the upload directories to prevent execution of uploaded scripts.
• Strip original file extensions from uploaded files to avoid execution of dangerous file types.

Useful 0 Not Useful 0