Description

The Vehicle Management System In PHP V1.0 by code-projects.org is vulnerable to unauthenticated Remote Code Execution via unrestricted file upload in newdriver.php (and identically in newvehicle.php).

The application exposes an admin-only "New Driver" registration form at newdriver.php that includes a photo upload field. However, the endpoint performs no session validation — any unauthenticated attacker can directly access it without being redirected to login. Furthermore, the photo upload field accepts any file type including PHP files, with no extension filtering, MIME type validation, or content inspection.

An attacker can:

1. Directly visit newdriver.php without any session or credentials
2. Submit the driver form with a PHP webshell as the "photo"
3. The shell is saved to the /picture/ directory
4. Navigate to the uploaded shell and execute arbitrary OS commands on the server

This results in full Remote Code Execution with the privileges of the web server process.

Vulnerability Chain

Steps to Reproduce

Step 1 — Confirm unauthenticated access to newdriver.php

Open a fresh browser with no session (incognito/private window). Navigate directly to the endpoint:

The New Driver Form loads successfully with no authentication check and no redirect to login.

Step 2 — Prepare the PHP webshell

Create a simple PHP command execution webshell:

Save it as shell.php (or any .php filename).

Step 3 — Submit the form with the webshell as the photo

Fill in the driver form fields with any values and select the PHP webshell as the photo upload:

Click Submit Query.

Step 4 — Shell upload confirmed

The application responds with "Registration Completed!" — confirming the PHP shell was accepted and saved with no validation.

Step 5 — Execute arbitrary commands via the uploaded shell

Navigate to the uploaded shell in the /picture/ directory and pass OS commands via the cmd parameter:

The server executes the command and returns the output:

Step 6 — Further command execution examples

Second Affected Endpoint — newvehicle.php

The identical vulnerability exists in newvehicle.php. An unauthenticated attacker can access the Add New Vehicle form, upload a PHP webshell via the vehicle photo field, and achieve RCE through the same method.

Both endpoints share the same root cause: no session validation and no file upload restrictions.

curl PoC (One-liner)

Impact

• Unauthenticated Remote Code Execution — any anonymous attacker on the network achieves full OS command execution
• Complete server compromise — read/write access to all files, credentials, database config
• No interaction required — fully automated exploit in a single HTTP request
• Two affected endpoints — newdriver.php and newvehicle.php both vulnerable

Affected Files

Vendor Information

• Vendor Homepage: https://code-projects.org/vehicle-management-system-in-php-with-source-code/
• Download: https://code-projects.org/vehicle-management-system-in-php-with-source-code/

Discovered By

Syed Imad Uddin Alvi (imad alvi)
Independent Security Researcher