SourceCodester Client Database Management System Remote Code Execution Vulnerability via Arbitrary File Upload

A remote code execution vulnerability has been identified in SourceCodester Client Database Management System version 1.0. This vulnerability arises from an arbitrary file upload feature in the 'user_proposal_update_order.php' file, which allows users to upload potentially dangerous files that could be executed on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the application is hosted.

Reproduction

To reproduce this vulnerability, upload a file through the 'user_proposal_update_order.php' interface. The file upload mechanism does not properly validate the file type or contents, allowing the upload of executable scripts such as PHP files. Once the file is uploaded, it can be accessed via the web server, triggering the execution of the uploaded script and resulting in remote code execution.