# CVE-2026-108973: SourceCodester Contact Tracing System unauthenticated file upload and SQL injection

Source: https://junglewise.ai/threats/cve-2026-108973-a-vulnerability-was-determined-in-sourcecodester-contact-tracing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108973 · Severity: high · CVSS 7.3 · Published 2026-10-13

SourceCodester Contact Tracing System is a web-based application for managing contact tracing operations. The application fails to authenticate requests to its file upload and user management endpoints, allowing an attacker to upload arbitrary PHP files for remote code execution and manipulate user accounts and database records without logging in. An attacker can execute commands on the server with the privileges of the web process, potentially compromising the entire system and all stored contact tracing data.

Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-108973 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108973 being exploited in the wild.

**How severe is CVE-2026-108973?** High severity, with a CVSS score of 7.3, published 13 October 2026.

**Which products and versions are affected?** SourceCodester Contact Tracing System 1.0.

**Is there a fix for CVE-2026-108973?** No fixed version is recorded yet. Add authentication checks at the top of classes/Users.php using session validation; block requests without valid admin session with HTTP 403. Disable PHP execution in the uploads/ directory using php_flag engine off in .htaccess. Use prepared statements with bind_param() for all SQL queries instead of string interpolation. Implement file upload validation: restrict uploads by MIME type (finfo), use randomized filenames, and explicitly block .php extensions. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108973 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108973?** Check whether you run SourceCodester Contact Tracing System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Add authentication checks at the top of classes/Users.php using session validation; block requests without valid admin session with HTTP 403. Disable PHP execution in the uploads/ directory using php_flag engine off in .htaccess. Use prepared statements with bind_param() for all SQL queries instead of string interpolation. Implement file upload validation: restrict uploads by MIME type (finfo), use randomized filenames, and explicitly block .php extensions.

## Technical details

The vulnerability exists in classes/Users.php, which dispatches save and delete operations with zero session or role validation. The save_users() function uses extract($_POST) and interpolates unvalidated POST parameters directly into an INSERT statement without prepared statements (SQL injection via CWE-89), allowing account creation as a full admin. The same endpoint accepts file uploads via move_uploaded_file() with no type, extension, or content validation (CWE-434), permitting .php shell uploads to a web-accessible directory. The delete_users() function directly interpolates the POST id parameter into a DELETE statement, enabling pre-authenticated SQL injection. All three vulnerabilities require only network access and no authentication or user interaction.

## Affected products

- SourceCodester Contact Tracing System 1.0

## Timeline

- 2026-09-25: disclosed: Vulnerability discovered and validated in local lab; advisory drafted but not sent to vendor or public
- 2026-10-13: advisory: CVE-2026-108973 assigned; advisory published

## References

- [https://tracexlabs.com/releases/contact-tracing-preauth-rce.html](https://tracexlabs.com/releases/contact-tracing-preauth-rce.html)
- [https://vuldb.com/cve/CVE-2026-108973](https://vuldb.com/cve/CVE-2026-108973)