CVE-2026-78245

itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload

View on CVE.org
Published Aug 24, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

Analysis

AI-generated

Technical impact

This vulnerability arises from the use of move_uploaded_file in the register.php script, where the photo parameter is not properly validated. An attacker can supply arbitrary file data, resulting in unrestricted upload. When the uploaded file contains executable code or a web script, the attacker may gain remote code execution or broader system compromise. The weakness involves improper access control (CWE-284) and uncontrolled upload due to missing file type restrictions (CWE-434).

Affected Systems

itsourcecode Online Pharmacy System version 1.0 is affected. No additional affected versions were listed.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. EPSS score is not reported, but the vulnerability is publicly documented and exploitable. It is not listed in CISA's KEV catalogue. The attack vector is remote, likely through an HTTP request to the register page, and it does not require authentication. Once the attacker uploads a malicious payload, they may execute code with the application's privileges or cause unintended behavior.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update itsourcecode Online Pharmacy System to the latest version that includes the upload validation fix.
  • Modify the register.php upload handler to restrict allowed file extensions and MIME types, and validate the file content before calling move_uploaded_file.
  • Ensure the upload directory is located outside the web‑accessible path or set permissions to prevent execution of uploaded files.

Generated by OpenCVE AI on August 24, 2026 at 12:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.
Title itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload
First Time appeared Itsourcecode
Itsourcecode online Pharmacy System
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:itsourcecode:online_pharmacy_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode online Pharmacy System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 24, 2026, 1:55 PM
Reserved
Aug 24, 2026, 5:28 AM

View source JSON

Updated
Aug 24, 2026, 1:55 PM

JSON

Status
Deferred
Published
Aug 24, 2026, 11:16 AM
Modified
Oct 12, 2026, 3:10 PM

View source JSON

No data.

Updated
Aug 24, 2026, 9:11 PM

JSON