Executive brief
Scholars Tracking System is a web-based application used to manage student records and profiles, including photo uploads. An authenticated attacker can upload a PHP file through the profile picture upload feature and execute arbitrary code on the web server, potentially gaining full access to the application's data, databases, and server infrastructure.
Technical details
This is an unrestricted file upload vulnerability (CWE-434) in the update_profile_picture.php and upload_picture.php endpoints. The application stores uploaded files directly in the web-accessible uploads/ directory using the original user-supplied filename without validating file type, extension, or MIME type. Because the web server executes PHP scripts within the uploads/ directory, an attacker with valid authentication credentials can upload a malicious PHP file and then request it directly via HTTP to achieve remote code execution (RCE) as the web server user. The vulnerability requires prior authentication but does not require user interaction beyond file upload. Patches should implement strict allowlist validation of file extensions/MIME types, use random filenames, disable PHP execution in upload directories, or serve uploads outside the web root.
Affected products
- code-projects Scholars Tracking System 1.0
Timeline
- 2026-02-18: disclosed: CVE-2025-70151 published
- 2025-12-27: other: Vulnerability discovered by MinhKhoa