menevarad007/cve-2026-37748Proof-of-concept exploit for CVE-2026-37748, an unrestricted file upload vulnerability in Visitor Management System 1.0 leading to remote code execution via PHP webshell upload.
| Field | Info |
|---|
| CVE ID | CVE-2026-37748 |
| Type | Unrestricted File Upload → Remote Code Execution |
| Severity | High (CVSSv3: 7.2) |
| Vendor | sanjay1313 |
| Product | Visitor Management System |
| Version | 1.0 |
| Discoverer | Varad AP Mene |
| Date | 2026-04-16 |
| CWE | CWE-434 |
A critical Unrestricted File Upload vulnerability exists in Visitor Management System 1.0 by sanjay1313. The move_uploaded_file() function in vms/php/admin_user_insert.php and vms/php/update_1.php is called without any MIME type, file extension, or content validation. An authenticated admin can upload a PHP webshell via the image upload field and achieve Remote Code Execution on the server by accessing the uploaded file directly via URL.
CVE ID: CVE-2026-37748 CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CVSSv3: 7.2 High (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Visitor Management System 1.0 is a PHP/MySQL web application by sanjay1313 on GitHub used to manage visitor records in organizations.
vms/php/admin_user_insert.php vms/php/update_1.php
$image = $_FILES['image']['name'];
$tmp = $_FILES['image']['tmp_name'];
move_uploaded_file($tmp, "../images/" . $image);
No validation of file extension, MIME type, or content.
Step 1 — Create webshell file shell.php:
Step 2 — Login to admin panel: http://target/vms/ Username: admin Password: admin
Step 3 — Upload shell.php as profile image: Navigate to Admin Users → Add New Admin Upload shell.php as profile photo
Step 4 — Execute commands: http://target/vms/images/shell.php?cmd=id http://target/vms/images/shell.php?cmd=whoami
// 1. Validate file extension
$allowed = ['jpg', 'jpeg', 'png', 'gif'];
$ext = strtolower(pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION));
if (!in_array($ext, $allowed)) {
die("Invalid file type");
}
// 2. Validate MIME type
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['image']['tmp_name']);
$allowed_mime = ['image/jpeg', 'image/png', 'image/gif'];
if (!in_array($mime, $allowed_mime)) {
die("Invalid MIME type");
}
// 3. Rename file on server
$new_name = uniqid() . '.' . $ext;
move_uploaded_file($_FILES['image']['tmp_name'], "../images/" . $new_name);
| Date | Event |
|---|---|
| 2026-03-15 | Vulnerability discovered |
| 2026-03-15 | Reported to MITRE |
| 2026-04-02 | CVE-2026-37748 assigned |
| 2026-04-16 | Public disclosure |
| 2026-04-16 | MITRE notified about publication |
| 2026-04-17 | Vendor notified via GitHub Issues |
Varad Arachana Prashant Mene