Executive brief
A security vulnerability exists in the SourceCodester Syllabus-Aligned Learning Management and Examination System, a platform used for managing educational courses and exams. An authenticated user, such as an instructor, can upload malicious files to the server because the system does not properly check file types. This could allow an attacker to take full control of the application server, access sensitive student data, or disrupt educational operations.
Technical details
An unrestricted file upload vulnerability exists in the 'upload_files.php' component of SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. The application fails to validate file extensions or MIME types for files uploaded by instructor-level users, storing them in the web-accessible 'uploads/class_docs/' directory with their original extensions. A remote attacker with instructor privileges can upload a malicious PHP script and execute it by accessing the file's URL directly. This leads to full Remote Code Execution (RCE) on the underlying web server. While the reported CVSS is 6.3 (Medium), the impact includes complete system compromise. No official patch is currently available.
Affected products
- SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0
Timeline
- 2026-06-03: disclosed: Initial discovery and PoC published on Pastebin
- 2026-07-05: advisory: CVE published and NVD/VulDB records created