Unrestricted File Upload Vulnerability in Criminal-Management-System

A vulnerability has been identified in the vraj404 Criminal-Management-System (up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4). The flaw resides in the move_uploaded_file function within the home.php file. By manipulating the my_img argument during a file upload request, an unauthenticated remote attacker can bypass intended file type restrictions, allowing the upload of malicious payloads to the server. Because the project utilizes a rolling release model and has not provided a patch following the issue report, users remain at risk of remote code execution if an attacker successfully uploads and executes a web shell. Public exploit code is available for this vulnerability, significantly increasing the likelihood of exploitation.

Impact

Successful exploitation allows a remote attacker to upload arbitrary files to the web server, which can lead to full system compromise if the attacker is able to execute the uploaded script (e.g., a web shell). This vulnerability poses a critical risk to any infrastructure hosting the Criminal-Management-System, as it is remotely exploitable without authentication.

Recommendation

1. Audit web server logs for HTTP POST requests to home.php containing suspicious file extensions (e.g., .php, .phtml, .php5) in the my_img parameter.
2. Implement strict file extension filtering and input validation on the web server side for all upload endpoints.
3. Restrict write permissions on the directory where uploaded files are stored to prevent web server execution of uploaded content.
4. Review access logs for non-standard file access patterns within the upload directory.