Executive brief
itsourcecode Payroll System is a PHP-based payroll management application used for processing employee payments and company settings. An unauthenticated attacker can upload arbitrary files (including executable PHP code) to the web server through the settings feature, leading to complete server compromise and data theft.
Technical details
The vulnerability is an unrestricted file upload (CWE-434) in the save_settings() function of admin_class.php. The vulnerable code accepts file uploads via the 'img' parameter with zero validation: no extension allowlist, no MIME type checking, and no file content inspection. Uploaded files are stored in the web-accessible assets/img/ directory with their original filename and extension intact. An unauthenticated attacker can exploit this over the network by sending a multipart POST request to /ajax.php?action=save_settings with a malicious PHP file, then execute arbitrary code by accessing the uploaded file via HTTP. The exploit is publicly disclosed and has proof-of-concept code available. No patch information is currently available.
Affected products
- itsourcecode Payroll System 1.0
Timeline
- 2026-07-11: disclosed: Vulnerability publicly disclosed on GitHub
- 2026-08-24: other: CVE-2026-78202 published on NVD