SourceCodester Pet Management System Unrestricted File Upload Vulnerability Leading to Remote Code Execution

A vulnerability allowing unrestricted file uploads has been identified in SourceCodester Pet Management System version 1.0. The issue resides in the admin/profile.php file, where the website_image parameter can be manipulated to upload arbitrary files, including PHP scripts. This flaw allows authenticated users to execute remote code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the application is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user must upload a file through the Profile Update form, specifically using the website_image parameter. The uploaded file can contain PHP code, which will be executed on the server.