Qingyuan Qin

**Name of the Vulnerable Software and Affected Versions** ProjectsAndPrograms School Management System versions prior to 6b6fae5426044f89c08d0dd101c7fa71f9042a59 **Description** A flaw exists in ProjectsAndPrograms School Management System that allows for unrestricted file upload due to insufficient input validation. The issue is related to the `/assets/uploadSllyabus.php` file and the `File` argument. This allows an attacker to upload malicious files, potentially including web shells or malware, and execute code remotely. The exploit has been publicly disclosed. **Recommendations** Versions prior to 6b6fae5426044f89c08d0dd101c7fa71f9042a59 should be updated. As a temporary workaround, restrict access to the `/assets/uploadSllyabus.php` file.

**Name of the Vulnerable Software and Affected Versions** ProjectsAndPrograms School Management System versions prior to commit hash 6b6fae5426044f89c08d0dd101c7fa71f9042a59 **Description** A flaw exists in ProjectsAndPrograms School Management System that allows attackers to bypass authentication. This is achieved through manipulation of the system and can be carried out remotely. The exploit has been made public. **Recommendations** Update ProjectsAndPrograms School Management System to a version beyond commit hash 6b6fae5426044f89c08d0dd101c7fa71f9042a59.