Unrestricted File Upload Vulnerability in SourceCodester E-Commerce System

Summary

A significant security flaw has been identified in the SourceCodester E-Commerce System version 1.0, specifically within the controller.php file located in the admin/products directory. This flaw stems from an insecure function that allows attackers to manipulate uploaded photos, resulting in unrestricted file uploads. Such vulnerabilities permit remote exploitation, enabling malicious users to upload arbitrary files to the server. The implications of this vulnerability are severe, as it opens the door to additional attacks, including web shell uploads and further compromise of the system. Immediate attention is required to mitigate the risks associated with this vulnerability.

References