CVE-2026-78245
Received Received - Intake

Unrestricted File Upload in Online Pharmacy System 1.0

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulDB

Description
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78245
EUVD
EUVD-2026-64824

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
itsourcecode online_pharmacy_system 1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in the Online Pharmacy System 1.0. It exists in the user registration function at all_users/register.php where the system fails to properly validate uploaded files. Attackers can manipulate the photo argument to upload malicious PHP files, such as shell.php, without restriction. These files are stored in a web-accessible directory, allowing remote attackers to execute arbitrary code on the server via crafted requests.

Detection Guidance

Check for unexpected PHP files in web-accessible directories, especially in the all_users/register.php upload path. Look for files with .php extensions or unusual names like shell.php. Use commands like 'find /var/www/html -name "*.php" -type f' to search for PHP files in web directories.

Impact Analysis

This vulnerability allows remote attackers to upload and execute malicious files on the server. If exploited, it could lead to complete server compromise, unauthorized data access, or further network infiltration. For users of the system, it may result in data breaches, loss of sensitive information, or disruption of services. The impact includes potential theft of customer data, defacement of the website, or use of the server for illegal activities.

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to the risk of unauthorized data access and exposure. GDPR mandates strict protection of personal data, and a breach could lead to significant fines. HIPAA requires safeguards for protected health information, and this flaw could result in unauthorized disclosure, triggering compliance violations and legal penalties.

Mitigation Strategies

Disable file uploads if not required. If uploads are necessary, implement strict validation: allowlist permitted file extensions, verify MIME types, use random filenames, and store files outside the web root. Update the application to validate file types during registration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart