Executive brief
The Online Pharmacy System is a web application used to manage pharmacy operations and user registration. An unauthenticated attacker can upload arbitrary files (including PHP webshells) through the user registration photo field with no validation, leading to remote code execution and complete compromise of the server.
Technical details
This is an unrestricted file upload vulnerability (CWE-434) in the user registration endpoint (all_users/register.php). The vulnerable move_uploaded_file() function at line 169 lacks any file extension checks, MIME type validation, or filename sanitization. Uploaded files are stored in a web-accessible directory with their original names, allowing an attacker to upload a PHP file that is then executable by the web server. The registration endpoint is unauthenticated and publicly accessible, making this a network-accessible vector. An attacker can upload a webshell and execute arbitrary system commands, achieving remote code execution and complete server compromise.
Affected products
- itsourcecode Online Pharmacy System 1.0
Timeline
- 2026-07-11: disclosed: Issue disclosed on GitHub
- 2026-08-24: advisory: CVE-2026-78245 published