Cpe:2.3:a:sourcecodester:contact_tracing_system:1.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asourcecodestercontact_tracing_system1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 13 Oct 2026 08:33:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnrestricted File Upload in SourceCodester Contact Tracing Systemhttps://feed.craftedsignal.io/briefs/2026-10-sourcecodester-rce/Tue, 13 Oct 2026 08:33:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-sourcecodester-rce/SourceCodester Contact Tracing System 1.0 is vulnerable to an unrestricted file upload flaw in the /classes/Users.php component, allowing remote attackers to achieve arbitrary file uploads.SourceCodester Contact Tracing System version 1.0 contains a critical security vulnerability related to unrestricted file uploads. The issue resides within the move_uploaded_file function located in the file /classes/Users.php when processing the 'img' or 'id' parameters during the 'save' action. This vulnerability allows an unauthenticated remote attacker to bypass intended file type restrictions and upload arbitrary files - such as web shells or malicious scripts - directly to the application's server. Because the application handles user-supplied input without sufficient sanitization or validation, this flaw can be leveraged to achieve remote code execution (RCE) on the underlying host, posing a significant risk to systems running this software.

Impact

Successful exploitation of this vulnerability permits unauthorized remote attackers to upload and execute arbitrary code on the server hosting the Contact Tracing System. This could lead to a full system compromise, exfiltration of sensitive contact tracing data, or further lateral movement within the network. The exploit has been publicly disclosed, increasing the likelihood of opportunistic exploitation attempts against internet-facing instances of this legacy or unpatched system.

Recommendation

  1. Inventory all instances of the SourceCodester Contact Tracing System within the environment to identify systems running version 1.0.
  2. Restrict access to the /classes/Users.php endpoint using network-level controls if immediate patching or decommissioning is not feasible.
  3. Implement egress filtering on the web server to prevent it from initiating outbound connections (reverse shells) following a successful exploit.
  4. Perform forensic analysis on the web server directory to detect unknown or unauthorized file uploads, particularly those with executable extensions.
]]>highadvisoryweb-application-vulnerabilityremote-code-executionfile-uploadsourcecodester