CVE-2026-10172
Description
Bdtask Multi-Store Inventory Management System 1.0 allows authenticated remote code execution via unrestricted module upload leading to inclusion of attacker-controlled PHP.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Bdtask Multi-Store Inventory Management System 1.0 allows authenticated remote code execution via unrestricted module upload leading to inclusion of attacker-controlled PHP.
Vulnerability
A remote code execution vulnerability exists in Bdtask Multi-Store Inventory Management System version 1.0. The upload() function in application/modules/dashboard/controllers/Module.php accepts ZIP archives via the module parameter without validating file contents. After extraction into application/modules/, the add.php view includes the attacker-controlled config/config.php using @include(), leading to arbitrary PHP execution [1].
Exploitation
An attacker must first authenticate as an administrator. They then prepare a malicious ZIP archive containing a PHP payload in config/config.php and upload it via the Add Module page. Upon reloading the Add Module page, the application executes the included PHP code, achieving remote code execution [1].
Impact
Successful exploitation allows the attacker to execute arbitrary PHP code on the server, leading to full compromise of the application and underlying system, including data theft, modification, or further lateral movement [1].
Mitigation
No official patch has been released as of the publication date. Administrators should restrict access to the module upload functionality to trusted users only and consider disabling the module feature if not required. The vulnerability is publicly documented and exploit code is available [1].
AI Insight generated on May 31, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2= 1.0+ 1 more
- (no CPE)range: = 1.0
- (no CPE)range: =1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Unsafe `@include()` of an attacker-controlled PHP file extracted from an uploaded ZIP archive without any validation of its contents."
Attack vector
An authenticated admin uploads a crafted ZIP archive containing a malicious `config/config.php` file via `POST /dashboard/module/upload`. The application extracts the archive into `application/modules/` without validating the file contents. When the attacker subsequently loads `GET /dashboard/module/add_module`, the view `add.php` executes `@include()` on the uploaded `config.php`, which runs arbitrary PHP code on the server [ref_id=1]. The attack is remote, requires an admin session, and no special network position beyond HTTP access.
Affected code
The vulnerable endpoint is `application/modules/dashboard/controllers/Module.php`, specifically the `upload()` function. The sink file is `application/modules/dashboard/views/module/add.php` at lines 50-51, where `@include($file)` is called on an attacker-controlled PHP file. A second `@include()` also exists in `Module.php::install()` at line 97 [ref_id=1].
What the fix does
No patch is published in the bundle. The advisory [ref_id=1] identifies the root cause as unsafe `@include()` of attacker-controlled PHP files in `add.php` (line 51) and `Module.php::install()` (line 97). A proper fix would validate that uploaded ZIP archives contain only expected asset files (images, SQL schemas) and never include executable PHP code, or alternatively remove the `@include()` entirely and use a safe parsing mechanism for module metadata.
Preconditions
- authAttacker must have a valid admin session (authenticated as admin)
- networkAttacker must have HTTP access to the application
- inputAttacker must craft a ZIP archive with a malicious config/config.php file
Reproduction
1. Log in with an admin account. 2. Prepare a ZIP archive with the structure `test_module/config/config.php` (containing malicious PHP code) plus required dummy files (`assets/data/database.sql`, `assets/images/thumbnail.jpg`). 3. Upload the ZIP via `POST /dashboard/module/upload` with the `module` parameter. 4. Load `GET /dashboard/module/add_module` to trigger `@include()` on the uploaded `config.php`. 5. Access the dropped webshell (e.g., `GET /shell.php?cmd=id`) [ref_id=1].
Generated on May 31, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5News mentions
0No linked articles in our index yet.