{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-108975/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sourcecodester:library_management_system:1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-108975"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Library Management System (1.0)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","unrestricted-upload","cve-2026-108975"],"_cs_type":"advisory","_cs_vendors":["SourceCodester"],"content_html":"\u003cp\u003eA security vulnerability has been identified in SourceCodester Library Management System version 1.0 that permits unrestricted file uploads. The flaw resides in the 'admin/add_admin.php' file, specifically within the handling of the 'image' argument during the 'move_uploaded_file' function execution. By manipulating this argument, an unauthenticated remote attacker can bypass file type validation to upload arbitrary files, such as malicious scripts, to the web server. This vulnerability has publicly available exploit code, increasing the likelihood of exploitation. Successful exploitation can lead to remote code execution (RCE) by accessing the uploaded file through the web application's document root, granting the attacker the ability to execute commands in the context of the web server service.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for remote code execution, which could lead to full system compromise of the underlying web server hosting the application. This poses a critical risk to data confidentiality and integrity for any organization currently running version 1.0 of the SourceCodester Library Management System.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIdentify all instances of SourceCodester Library Management System 1.0 within the environment.\u003c/li\u003e\n\u003cli\u003eIf the application cannot be patched or upgraded to a version where this vulnerability is remediated, restrict access to the 'admin/add_admin.php' endpoint to trusted administrative IP addresses via web server access controls.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP POST requests directed at 'admin/add_admin.php' containing suspicious filenames or content-types in the 'image' parameter.\u003c/li\u003e\n\u003cli\u003eImplement strict file extension filtering and mime-type verification on the server side to prevent the upload of executable scripts (e.g., .php, .php5, .phtml).\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-13T08:33:51Z","date_published":"2026-10-13T08:33:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-library-management-upload/","summary":"SourceCodester Library Management System 1.0 is vulnerable to an unrestricted file upload flaw via the 'image' argument in 'admin/add_admin.php', potentially enabling remote code execution.","title":"Unrestricted File Upload Vulnerability in SourceCodester Library Management System","url":"https://feed.craftedsignal.io/briefs/2026-10-library-management-upload/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-108975","version":"https://jsonfeed.org/version/1.1"}