Unrestricted File Upload in SourceCodester E-Learning System

A security vulnerability identified as CVE-2026-108974 exists in the SourceCodester E-Learning System version 1.0. The flaw resides in the 'save_users' function located within '/classes/Users.php'. An unauthenticated or authenticated remote attacker can manipulate the 'img' argument during a file upload process to bypass restrictions, resulting in the ability to upload arbitrary files to the web server. This vulnerability is significant because a publicly available exploit exists, lowering the barrier for entry for potential attackers. If exploited, an attacker could upload malicious scripts, such as web shells, to achieve remote code execution on the underlying host, leading to full system compromise.

Impact

Successful exploitation of this vulnerability allows for arbitrary file upload, which is a precursor to full application takeover. In an educational environment, this could lead to the exposure of student and faculty records, unauthorized access to administrative functions, or the use of the server as a pivot point for lateral movement within the network.

Recommendation

Prioritize the identification and isolation of any instances of SourceCodester E-Learning System 1.0 within the environment. If the software is in use, verify if patches or vendor updates are available, or restrict access to the application via network-level controls until a secure configuration or update is applied.