Attack Chain

1. Attacker authenticates as a low-privileged user (e.g., guard account).
2. Attacker interacts with /vms/php/phone_0.php and injects SQL commands into the phone POST parameter.
3. Attacker uses SQL injection to exfiltrate the login_user table from the vms database.
4. Attacker recovers plaintext administrative credentials from the dump.
5. Attacker authenticates to the application using the harvested admin credentials.
6. Attacker navigates to the Admin User management panel at /vms/php/admin_user_0.php.
7. Attacker uploads a malicious PHP webshell through the profile image upload field, which lacks file validation.
8. Attacker accesses the uploaded webshell via a direct URL and executes OS commands to achieve full system compromise.

Impact

Successful exploitation results in full database compromise, unauthorized administrative access, and arbitrary code execution on the underlying server. Because passwords are stored in plaintext within the database, the impact is magnified as no further cracking effort is required by an attacker.

Recommendation

• Immediately restrict access to the Visitor Management System to authorized networks or require robust multi-factor authentication for all users.
• Audit the /vms/php/ directory for any unauthorized files, specifically .php files created by non-administrative users.
• Apply strict file-type validation and extension filtering on all upload inputs within the application.
• Implement parameterized queries across all database interaction modules to remediate the SQL injection vulnerability.
• Upgrade or patch Visitor Management System if a fix becomes available from code-projects.org.