Unrestricted File Upload Vulnerability in itsourcecode Online Pharmacy System

A security vulnerability identified as CVE-2026-78245 affects the itsourcecode Online Pharmacy System version 1.0. The vulnerability is located within the 'all_users/register.php' file, specifically in the component responsible for user registration. An attacker can manipulate the 'photo' argument passed to the 'move_uploaded_file' function, allowing for the unrestricted upload of arbitrary files to the server. Because the application fails to adequately validate or restrict the file types processed by this function, a remote, unauthenticated attacker could upload malicious scripts, such as web shells, leading to remote code execution. This vulnerability is highly critical due to the lack of required authentication, allowing exploitation by any remote actor with network access to the target application. Public exploit code has been reported, making this an immediate risk to organizations running this specific version of the software.

Attack Chain

1. Attacker performs reconnaissance to identify systems running itsourcecode Online Pharmacy System 1.0.
2. Attacker navigates to the public user registration page located at /all_users/register.php.
3. Attacker initiates a registration request, intercepting the HTTP request using a proxy tool.
4. Attacker modifies the 'photo' parameter in the POST request to point to a malicious file, such as a PHP web shell.
5. The application's 'move_uploaded_file' function processes the malicious request without validating the file extension or content.
6. The web server saves the attacker-supplied file into a directory accessible by the web root.
7. Attacker requests the newly uploaded file via the browser to trigger execution of the malicious script.
8. Attacker achieves remote command execution with the privileges of the web server service account.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to gain remote code execution on the underlying server. This can lead to full system compromise, data theft, ransomware deployment, or use of the server as a pivot point for further lateral movement within the target organization's network. Given the nature of the application as a pharmacy management system, the potential exposure of sensitive patient and operational data is significant.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Deploy a web application firewall (WAF) rule to inspect and block requests to '/all_users/register.php' that contain suspicious file extensions (e.g., .php, .php5, .phtml) within the 'photo' parameter.
• Implement monitoring for new file creation events within the web directory where user-uploaded photos are stored.
• Audit the web server configuration to ensure that file execution permissions are restricted in user upload directories.
• Identify and decommission any production instances of 'Online Pharmacy System' 1.0 until a security patch is provided by the vendor.