Cpe:2.3:a:sourcecodester:e-Learning_system:1.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asourcecodestere-learning_system1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 13 Oct 2026 08:33:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnrestricted File Upload in SourceCodester E-Learning Systemhttps://feed.craftedsignal.io/briefs/2026-10-sourcecodester-e-learning-upload/Tue, 13 Oct 2026 08:33:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-sourcecodester-e-learning-upload/SourceCodester E-Learning System 1.0 contains an unrestricted file upload vulnerability in the save_users function, allowing remote attackers to upload arbitrary files to the server.A security vulnerability identified as CVE-2026-108974 exists in the SourceCodester E-Learning System version 1.0. The flaw resides in the 'save_users' function located within '/classes/Users.php'. An unauthenticated or authenticated remote attacker can manipulate the 'img' argument during a file upload process to bypass restrictions, resulting in the ability to upload arbitrary files to the web server. This vulnerability is significant because a publicly available exploit exists, lowering the barrier for entry for potential attackers. If exploited, an attacker could upload malicious scripts, such as web shells, to achieve remote code execution on the underlying host, leading to full system compromise.

Impact

Successful exploitation of this vulnerability allows for arbitrary file upload, which is a precursor to full application takeover. In an educational environment, this could lead to the exposure of student and faculty records, unauthorized access to administrative functions, or the use of the server as a pivot point for lateral movement within the network.

Recommendation

Prioritize the identification and isolation of any instances of SourceCodester E-Learning System 1.0 within the environment. If the software is in use, verify if patches or vendor updates are available, or restrict access to the application via network-level controls until a secure configuration or update is applied.

]]>highadvisoryweb-vulnerabilityremote-code-executionfile-upload