Unrestricted File Upload in Online Faculty Clearance System

Executive Summary

This vulnerability is an unrestricted file upload flaw in the Online Faculty Clearance System 1.0. It exists in the move_uploaded_file function of production/edit_picture.php where the File argument is not properly validated. Attackers can upload malicious files, such as PHP scripts, by manipulating the filename and content. The uploaded files are stored in a web-accessible directory, allowing remote code execution when accessed.

Useful 0 Not Useful 0

Detection Guidance

Check for unexpected PHP files in the web-accessible directory ../requirements/. Look for files with suspicious names like shell.php or files with unusual extensions. Inspect server logs for upload requests to production/edit_picture.php with modified filenames.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to upload and execute arbitrary server-side code, leading to full system compromise. This includes stealing sensitive data, taking over user accounts, or maintaining persistent access to the server. The attack requires valid faculty credentials but can be carried out remotely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Implement strict file extension and MIME type allowlists. Store uploaded files outside the web root. Disable PHP execution in upload directories. Use random filenames for uploaded files. Enforce server-side authorization and CSRF protection.

Useful 0 Not Useful 0