code-projects Online Examination System Unrestricted File Upload Vulnerability in admin_pic.php

A vulnerability allowing unrestricted file uploads has been identified in code-projects Online Examination System version 1.0. The issue resides in the file admin_pic.php, where the 'Change Picture' feature fails to restrict file types, enabling remote upload of malicious files, such as PHP web shells, which can lead to unauthorized code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the application is hosted.

Reproduction

To reproduce this vulnerability, access the 'Change Picture' feature, which triggers the admin_pic.php file. Since there are no restrictions on file types, upload a PHP file that contains a web shell. Once uploaded, the web shell can be executed to gain remote code execution on the server.