SourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted upload

Vulnerability

A flaw exists in the file upload functionality of SourceCodester Simple POS and Inventory System version 1.0. The endpoint /admin/addproduct.php accepts an image parameter and only validates the file extension against a whitelist (jpg or png). The validation can be bypassed using double extensions (e.g., shell.php.jpg) or uppercase extensions, allowing arbitrary file uploads. The uploaded file is stored in the web-accessible /upload/ directory. This vulnerability is detailed in the published exploit [1].

Exploitation

An attacker can send a crafted POST request to /admin/addproduct.php with a malicious PHP file (e.g., a webshell) as the image parameter. The application's weak extension check permits the upload. No authentication is required, and the attack can be performed remotely over HTTP. The uploaded file is accessible via the /upload/ directory, enabling direct execution of PHP code.

Impact

Successful exploitation allows an attacker to achieve remote code execution (RCE) on the server. By uploading a PHP webshell, the attacker can execute arbitrary system commands, read or modify files, and potentially compromise the entire application and underlying server. The impact is critical, as the attacker gains full control over the web application context.

Mitigation

As of the publication date, no official patch has been released for version 1.0. The vendor has not addressed the vulnerability [1]. Until a fix is available, administrators should implement strict file type validation (e.g., MIME type checking), rename uploaded files to remove executable extensions, and restrict the /upload/ directory from executing PHP code (e.g., via .htaccess or web server configuration). The vulnerability is unpatched and publicly exploited.