{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/contact-tracing-system-1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sourcecodester:contact_tracing_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-108973"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Contact Tracing System (1.0)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","remote-code-execution","file-upload","sourcecodester"],"_cs_type":"advisory","_cs_vendors":["SourceCodester"],"content_html":"\u003cp\u003eSourceCodester Contact Tracing System version 1.0 contains a critical security vulnerability related to unrestricted file uploads. The issue resides within the move_uploaded_file function located in the file /classes/Users.php when processing the 'img' or 'id' parameters during the 'save' action. This vulnerability allows an unauthenticated remote attacker to bypass intended file type restrictions and upload arbitrary files - such as web shells or malicious scripts - directly to the application's server. Because the application handles user-supplied input without sufficient sanitization or validation, this flaw can be leveraged to achieve remote code execution (RCE) on the underlying host, posing a significant risk to systems running this software.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability permits unauthorized remote attackers to upload and execute arbitrary code on the server hosting the Contact Tracing System. This could lead to a full system compromise, exfiltration of sensitive contact tracing data, or further lateral movement within the network. The exploit has been publicly disclosed, increasing the likelihood of opportunistic exploitation attempts against internet-facing instances of this legacy or unpatched system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of the SourceCodester Contact Tracing System within the environment to identify systems running version 1.0.\u003c/li\u003e\n\u003cli\u003eRestrict access to the /classes/Users.php endpoint using network-level controls if immediate patching or decommissioning is not feasible.\u003c/li\u003e\n\u003cli\u003eImplement egress filtering on the web server to prevent it from initiating outbound connections (reverse shells) following a successful exploit.\u003c/li\u003e\n\u003cli\u003ePerform forensic analysis on the web server directory to detect unknown or unauthorized file uploads, particularly those with executable extensions.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-13T08:33:34Z","date_published":"2026-10-13T08:33:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sourcecodester-rce/","summary":"SourceCodester Contact Tracing System 1.0 is vulnerable to an unrestricted file upload flaw in the /classes/Users.php component, allowing remote attackers to achieve arbitrary file uploads.","title":"Unrestricted File Upload in SourceCodester Contact Tracing System","url":"https://feed.craftedsignal.io/briefs/2026-10-sourcecodester-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Contact Tracing System (1.0)","version":"https://jsonfeed.org/version/1.1"}