Unrestricted File Upload Vulnerability in SourceCodester Library Management System

A security vulnerability has been identified in SourceCodester Library Management System version 1.0 that permits unrestricted file uploads. The flaw resides in the 'admin/add_admin.php' file, specifically within the handling of the 'image' argument during the 'move_uploaded_file' function execution. By manipulating this argument, an unauthenticated remote attacker can bypass file type validation to upload arbitrary files, such as malicious scripts, to the web server. This vulnerability has publicly available exploit code, increasing the likelihood of exploitation. Successful exploitation can lead to remote code execution (RCE) by accessing the uploaded file through the web application's document root, granting the attacker the ability to execute commands in the context of the web server service.

Impact

The vulnerability allows for remote code execution, which could lead to full system compromise of the underlying web server hosting the application. This poses a critical risk to data confidentiality and integrity for any organization currently running version 1.0 of the SourceCodester Library Management System.

Recommendation

1. Identify all instances of SourceCodester Library Management System 1.0 within the environment.
2. If the application cannot be patched or upgraded to a version where this vulnerability is remediated, restrict access to the 'admin/add_admin.php' endpoint to trusted administrative IP addresses via web server access controls.
3. Monitor web server logs for HTTP POST requests directed at 'admin/add_admin.php' containing suspicious filenames or content-types in the 'image' parameter.
4. Implement strict file extension filtering and mime-type verification on the server side to prevent the upload of executable scripts (e.g., .php, .php5, .phtml).