Executive brief
The Record Management System, a tool used for managing personnel data, contains a security flaw in its employee registration page. An attacker with administrative access can upload malicious files to the server, potentially leading to a complete takeover of the system. This could result in the theft of sensitive employee records, data deletion, or the installation of ransomware.
Technical details
An unrestricted file upload vulnerability exists in 'save_emp.php' within the Add Employee Page component of the Record Management System 1.0. The application uses 'move_uploaded_file()' to save files to the '/upload/' directory without validating file extensions. While 'getimagesize()' is called, its return value is not used to restrict uploads to valid image types. A remote attacker with high privileges (or one who has bypassed authentication via SQL injection) can upload a PHP shell to achieve Remote Code Execution (RCE). A public Proof of Concept (PoC) exists demonstrating this attack.
Affected products
- SourceCodester Record Management System 1.0
- jkev Record Management System 1.0
Timeline
- 2026-04-05: disclosed
- 2026-04-05: advisory