SourceCodester Best Employee Management System Profile Picture unrestricted upload

Vulnerability

The vulnerability is an unrestricted file upload issue in SourceCodester Best Employee Management System version 1.0. It resides in the Profile Picture Handler component, specifically in the file /_hr_soft/assets/uploadImage/Profile/. An attacker can upload arbitrary files without proper validation, leading to potential code execution.

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted HTTP request to the profile picture upload endpoint. No authentication is required. The attacker simply uploads a malicious file (e.g., a PHP web shell) as the profile image, which is then stored on the server.

Impact

Successful exploitation allows the attacker to upload arbitrary files, which can lead to remote code execution on the server. The attacker gains unauthorized access, potentially compromising the entire application and underlying system.

Mitigation

As of the publication date (2025-02-23), no official patch or fix has been released for CVE-2025-1593. Users are advised to restrict access to the upload functionality, implement file type validation, and monitor for suspicious uploads. The product may be end-of-life as it is a free source code project.