Scholars Tracking System 1.0 Fails to Validate File Uploads

Summary

An attacker who is logged in to the Scholars Tracking System can upload any type of file, including malicious PHP code. This can allow them to take control of the server and execute their own code. To fix this, the system's developers should update the upload process to only allow safe file types and validate file extensions to prevent code execution.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
fabian	scholars_tracking_system	1.0	–

Original title

code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_pictur...

Original description

code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied filename without validating the file type or extension. By uploading a PHP file and then requesting it from /uploads/, an attacker can execute arbitrary PHP code as the web server user.

nvd CVSS3.1 8.8

Vulnerability type

CWE-434 Unrestricted File Upload

https://code-projects.org/scholars-tracking-system-in-php-with-source-code/ Product
https://youngkevinn.github.io/posts/CVE-2025-70151-Scholars-FileUpload-RCE/ Exploit Mitigation Third Party Advisory