SourceCodester Best Church Management Software Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in SourceCodester Best Church Management Software version 1.0. The issue resides in the file '/admin/app/profile_crud.php', where the 'old_cat_img' parameter can be manipulated to traverse directories and access '../filedir'. This vulnerability can be exploited remotely, potentially leading to unauthorized file deletion.

Impact

Exploitation of this vulnerability allows for arbitrary file deletion on the server.

Reproduction

To reproduce this vulnerability, send a POST request to '/admin/app/profile_crud.php' with the 'old_cat_img' parameter set to a path traversal payload, such as '../../htaccess'. This can be done using a tool like Burp Suite or Postman, by selecting 'multipart/form-data' as the content type and including the desired file traversal payload in the 'old_cat_img' field.