CVE-2026-6489: QueryMine SMS RCE Vulnerability

CVE-2026-6489 Overview

A security flaw has been discovered in QueryMine SMS affecting versions up to commit 7ab5a9ea196209611134525ffc18de25c57d9593. This vulnerability exists in the file admin/addteacher.php within the Background Management Page component. The manipulation of the image argument results in an unrestricted file upload vulnerability that can be exploited remotely by authenticated attackers. The exploit has been publicly released and may be actively used for attacks. The vendor was contacted about this disclosure but did not respond.

Critical Impact
Remote attackers with low-level privileges can upload arbitrary files to the server, potentially leading to remote code execution, server compromise, or defacement of the web application.

Affected Products

QueryMine SMS (up to commit 7ab5a9ea196209611134525ffc18de25c57d9593)
QueryMine SMS Background Management Page component
QueryMine SMS admin/addteacher.php file

Discovery Timeline

April 17, 2026 - CVE-2026-6489 published to NVD
April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6489

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), which encompasses issues related to inadequate restrictions on file uploads. The unrestricted upload vulnerability in the admin/addteacher.php file allows attackers to bypass intended file type restrictions and upload malicious files to the server.

The vulnerable component resides within the Background Management Page, specifically in the teacher addition functionality. When processing the image parameter, the application fails to properly validate the file type, extension, or content of uploaded files. This lack of validation enables attackers to upload executable scripts, web shells, or other malicious content that can subsequently be accessed to execute arbitrary code on the server.

The attack requires network access and low-level privileges, meaning an attacker needs some form of authentication to the administrative interface. However, once this access is obtained, the exploitation is straightforward with no user interaction required.

Root Cause

The root cause of this vulnerability is improper input validation on file uploads within the admin/addteacher.php script. The application does not implement sufficient checks on the image parameter to ensure that only legitimate image files are accepted. Missing controls may include:

Lack of file extension whitelisting
Missing MIME type validation
Absence of file content verification
No restrictions on upload directory execution permissions

The absence of these security controls allows attackers to upload arbitrary files, including PHP scripts that can be executed by the web server.

Attack Vector

The attack can be launched remotely over the network. An attacker with low-level privileges to the administrative interface can craft a malicious request to the admin/addteacher.php endpoint, manipulating the image parameter to upload a web shell or other malicious file. Once uploaded, the attacker can access the uploaded file directly through the web server to execute arbitrary commands.

The exploitation mechanism involves:

Authenticating to the administrative interface with low-level privileges
Navigating to the teacher addition functionality
Crafting a malicious file disguised or submitted as an image
Uploading the file through the vulnerable image parameter
Accessing the uploaded file to trigger code execution

For detailed technical information about this vulnerability, refer to the VulDB Vulnerability Entry and the GitHub Deployment Document.

Detection Methods for CVE-2026-6489

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .php5) in upload directories
Web server access logs showing requests to unusual files in upload locations
Suspicious POST requests to admin/addteacher.php with abnormal file content or extensions
Newly created files in web-accessible directories with recent timestamps

Detection Strategies

Monitor file system changes in web application upload directories for non-image file types
Implement web application firewall (WAF) rules to detect file upload attacks targeting PHP applications
Review web server access logs for suspicious patterns involving admin/addteacher.php
Deploy endpoint detection to identify web shell characteristics in uploaded files

Monitoring Recommendations

Enable file integrity monitoring on the web application's upload directories
Configure alerts for new PHP files created outside of normal deployment processes
Monitor outbound connections from the web server for potential command and control activity
Implement logging for all administrative actions within the QueryMine SMS application

How to Mitigate CVE-2026-6489

Immediate Actions Required

Restrict access to the admin/addteacher.php endpoint to trusted IP addresses only
Implement strict file upload validation including extension whitelisting and MIME type checking
Disable script execution in upload directories via web server configuration
Review and audit existing uploaded files for potentially malicious content

Patch Information

No official patch is currently available from the vendor. The vendor was contacted early about this disclosure but did not respond. Organizations using QueryMine SMS should implement the workarounds listed below and consider migrating to an actively maintained alternative. Monitor the VulDB entry for updates on potential patches.

Workarounds

Configure web server to prevent execution of scripts in upload directories
Implement server-side file validation to only allow legitimate image files (JPEG, PNG, GIF)
Restrict access to administrative functions using IP whitelisting or VPN requirements
Consider disabling the teacher image upload functionality until a proper fix is available

bash

# Apache configuration to disable script execution in upload directories
# Add to .htaccess or Apache configuration file
<Directory "/path/to/querymine/uploads">
    php_admin_flag engine Off
    <FilesMatch "\.(php|phtml|php5|php7)$">
        Deny from all
    </FilesMatch>
</Directory>