CVE-2026-78245: Online Pharmacy System File Upload Vulnerability

CVE-2026-78245 Overview

CVE-2026-78245 is an unrestricted file upload vulnerability in itsourcecode Online Pharmacy System 1.0. The flaw resides in the move_uploaded_file function within all_users/register.php, part of the User Registration component. Attackers can manipulate the photo argument to upload arbitrary files without validation. The attack requires no authentication and can be launched remotely over the network. A public exploit has been disclosed, increasing the risk of opportunistic scanning and abuse against exposed installations.

Critical Impact
Remote, unauthenticated attackers can upload arbitrary files through the registration form, potentially planting web shells that lead to code execution on the hosting server.

Affected Products

itsourcecode Online Pharmacy System 1.0
Component: User Registration (all_users/register.php)
Function: move_uploaded_file

Discovery Timeline

2026-08-24 - CVE-2026-78245 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78245

Vulnerability Analysis

The vulnerability is classified under [CWE-284: Improper Access Control] and manifests as an unrestricted file upload weakness. The register.php script accepts a photo parameter during account registration and passes it directly to PHP's move_uploaded_file without validating the file extension, MIME type, or content signature. Because the destination directory is web-accessible, an attacker can upload server-side executable content such as PHP scripts and request them directly through the browser. The registration endpoint does not require authentication, so exploitation reduces to a single crafted multipart HTTP POST request.

Root Cause

The root cause is missing input validation and access control on the profile photo upload path. The application trusts client-supplied file metadata and does not enforce an allowlist of safe extensions or store uploads outside the web root. Combined with unauthenticated access to the registration flow, this design places arbitrary file writes within reach of any remote user.

Attack Vector

An attacker sends a multipart form POST to the all_users/register.php endpoint with a malicious file supplied in the photo field, for example a PHP web shell with a .php or double extension. Once written to the uploads directory, the attacker requests the file over HTTP, triggering server-side execution. This provides an initial foothold that can be used for reconnaissance, database access, or lateral movement. Technical details are documented in the VulDB entry for CVE-2026-78245 and the GitHub issue discussion.

Detection Methods for CVE-2026-78245

Indicators of Compromise

Unexpected .php, .phtml, or double-extension files (e.g. image.php.jpg) present in the uploads directory used by the User Registration component.
Web server access log entries showing POST requests to all_users/register.php followed by GET requests to newly created files under the uploads path.
Outbound network connections initiated by the PHP-FPM or web server process to unfamiliar hosts shortly after registration activity.

Detection Strategies

Inspect HTTP request bodies to register.php for Content-Disposition headers where the photo field carries executable extensions or PHP tags in the file content.
Correlate file-write events on the web root with the web server process to identify uploads outside expected image formats.
Alert on execution of interpreter processes (e.g. sh, bash, python) spawned as children of the web server or PHP handler.

Monitoring Recommendations

Enable web application firewall logging in front of the Online Pharmacy System and retain full request payloads for the registration endpoint.
Baseline the uploads directory contents and generate integrity alerts when new server-executable files appear.
Forward web server, file integrity, and process telemetry to a centralized analytics platform for cross-source correlation.

How to Mitigate CVE-2026-78245

Immediate Actions Required

Restrict or disable public access to all_users/register.php until a validated fix is in place, using network ACLs or authentication in front of the application.
Remove execution permissions on the uploads directory at the web server level so that .php files placed there cannot be interpreted.
Audit the uploads directory for unauthorized files and rotate any credentials or secrets accessible from the web root if suspicious files are found.

Patch Information

No official vendor patch has been published in the referenced advisories at the time of this writing. Operators should monitor itsourcecode.com and the VulDB vulnerability summary for remediation guidance and apply updates when available.

Workarounds

Implement a strict server-side allowlist of image MIME types and extensions, and verify file signatures before calling move_uploaded_file.
Rename uploaded files to a random identifier and store them outside the web root, serving them through a controlled handler.
Deploy a web application firewall rule that blocks multipart uploads to register.php where the photo part contains PHP tags or non-image content types.

bash

# Apache configuration example: prevent PHP execution in the uploads directory
<Directory "/var/www/online-pharmacy/all_users/uploads">
    php_admin_flag engine off
    RemoveHandler .php .phtml .php5
    RemoveType .php .phtml .php5
    <FilesMatch "\.(php|phtml|php5|phar)$">
        Require all denied
    </FilesMatch>
</Directory>