Unrestricted File Upload in Payroll System 1.0

Executive Summary

This vulnerability is in the itsourcecode Payroll System 1.0, specifically in the save_settings function of admin_class.php. It allows unrestricted file uploads without proper validation, enabling attackers to upload arbitrary PHP files. The function fails to check file extensions, MIME types, or file content, allowing malicious code execution from the web-accessible assets/img/ directory.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in the assets/img/ directory of the Payroll System. Look for files with unexpected extensions or recent upload timestamps. Review network traffic for POST requests to /ajax.php?action=save_settings with file uploads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to upload and execute malicious PHP files on your server. This could lead to remote code execution, allowing them to take control of your system, steal sensitive data, or disrupt services. Since the vulnerability is accessible remotely and requires no authentication, any exposed instance of this system is at high risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using this system may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict write permissions to the assets/img/ directory. Implement strict file upload validation to allow only specific safe file types. Add authentication checks for the /ajax.php?action=save_settings endpoint. Monitor for suspicious file uploads or PHP execution attempts.

Useful 0 Not Useful 0