PT-2021-16452 · Sourcecodester · Sourcecodester Loan Management System

Published 2021-07-28 · Updated 2021-08-03 · CVE-2021-25200

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SourceCodester Learning Management System version 1.0

Description: The issue allows attackers to upload arbitrary files, which can lead to the execution of arbitrary code. This is achieved by uploading files to the student avatar.php script located in the lms directory.

Recommendations: For SourceCodester Learning Management System version 1.0, consider restricting access to the student avatar.php script until a fix is available, or remove the ability to upload files to this endpoint to prevent exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-25200

Affected Products

Sourcecodester Loan Management System

References · 3

• 🔥 https://github.com/TCSWT/Learning-Management-System/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2021-25200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25200 · Security Note