SourceCodester Online Book Store System Unrestricted File Upload Vulnerability Allowing Remote Code Execution

A critical vulnerability has been identified in SourceCodester Online Book Store System version 1.0, specifically within the Book Image Upload feature. The issue resides in an unknown function of the file '/admin/index.php?page=books', where the application fails to properly validate uploaded files. This lack of validation allows authenticated administrators to upload arbitrary files, including malicious PHP scripts, which can be executed on the server. The vulnerability can be exploited remotely, leading to unauthorized execution of commands on the server with the same privileges as the web server process.

Impact

Exploitation of this vulnerability allows authenticated administrators to execute arbitrary operating system commands on the server, potentially leading to a complete compromise of the web application. Depending on the server environment and privileges, this could result in full control over the server.

Reproduction

To reproduce this vulnerability, log into the administrative dashboard with valid credentials. Once authenticated, navigate to the 'Books' section and use the image upload feature to upload a PHP file containing a web shell, such as one that executes commands via a 'cmd' parameter. After saving the upload, the file can be accessed through the web server, and commands can be executed via the uploaded script.

Remediation

To address this vulnerability, restrict file uploads to approved image formats, validate MIME types and file signatures server-side, rename uploaded files with random identifiers, and store uploads outside the web root. Additionally, disable PHP execution in the uploads directory.