{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/visitor-management-system-1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:code_projects_org:visitor_management_system:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.3,"id":"CVE-2026-10170"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Visitor Management System (1.0)"],"_cs_severities":["low"],"_cs_tags":["web-application-vulnerability","rce","sqli","arbitrary-file-upload"],"_cs_type":"advisory","_cs_vendors":["code-projects.org"],"content_html":"\u003cp\u003eVisitor Management System 1.0, developed by code-projects.org, contains a critical attack chain involving two distinct vulnerabilities: a SQL injection (CWE-89) in \u003ccode\u003epass.php\u003c/code\u003e and an unrestricted file upload (CWE-434) in \u003ccode\u003eadmin_user_0.php\u003c/code\u003e. Successful exploitation allows an attacker with low-privileged access to exfiltrate administrative credentials stored in plaintext and subsequently execute arbitrary OS commands on the host server.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates as a low-privileged user (e.g., guard account).\u003c/li\u003e\n\u003cli\u003eAttacker interacts with \u003ccode\u003e/vms/php/phone_0.php\u003c/code\u003e and injects SQL commands into the \u003ccode\u003ephone\u003c/code\u003e POST parameter.\u003c/li\u003e\n\u003cli\u003eAttacker uses SQL injection to exfiltrate the \u003ccode\u003elogin_user\u003c/code\u003e table from the \u003ccode\u003evms\u003c/code\u003e database.\u003c/li\u003e\n\u003cli\u003eAttacker recovers plaintext administrative credentials from the dump.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the application using the harvested admin credentials.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the Admin User management panel at \u003ccode\u003e/vms/php/admin_user_0.php\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker uploads a malicious PHP webshell through the profile image upload field, which lacks file validation.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the uploaded webshell via a direct URL and executes OS commands to achieve full system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full database compromise, unauthorized administrative access, and arbitrary code execution on the underlying server. Because passwords are stored in plaintext within the database, the impact is magnified as no further cracking effort is required by an attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately restrict access to the Visitor Management System to authorized networks or require robust multi-factor authentication for all users.\u003c/li\u003e\n\u003cli\u003eAudit the \u003ccode\u003e/vms/php/\u003c/code\u003e directory for any unauthorized files, specifically \u003ccode\u003e.php\u003c/code\u003e files created by non-administrative users.\u003c/li\u003e\n\u003cli\u003eApply strict file-type validation and extension filtering on all upload inputs within the application.\u003c/li\u003e\n\u003cli\u003eImplement parameterized queries across all database interaction modules to remediate the SQL injection vulnerability.\u003c/li\u003e\n\u003cli\u003eUpgrade or patch Visitor Management System if a fix becomes available from code-projects.org.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T04:06:00Z","date_published":"2026-10-24T04:06:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-visitor-management-system-rce/","summary":"Visitor Management System 1.0 is vulnerable to a critical attack chain where SQL injection in 'pass.php' leads to plaintext credential theft and subsequent unrestricted file upload in 'admin_user_0.php' for remote code execution.","title":"Visitor Management System: SQL injection and unrestricted file upload (CVE-2026-10170)","url":"https://feed.craftedsignal.io/briefs/2026-10-visitor-management-system-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Visitor Management System (1.0)","version":"https://jsonfeed.org/version/1.1"}