CVE6-4.md

Vendor

itsourcecode

Product

University Management System

version

1.0

Download Source Code: https://itsourcecode.com/wp-content/uploads/2022/01/University-Management-System-Project-In-PHP-Source-Code.zip

Description

Register and log in with a student account。When visiting the /st_update.php?id=123321 page, the value corresponding to id is StudentID. You can upload an avatar file, but the page does not impose any restrictions on the uploaded files, resulting in attackers being able to directly upload PHP trojan files.

Analysis

The /st_update.php page does not restrict the files that are uploaded.

POC