CVE-2026-37748 Details
Description
Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_uploaded_file() function is called without any MIME type, extension, or content validation, allowing an authenticated admin to upload a PHP webshell and achieve Remote Code Execution on the server.
A vulnerability allowing unrestricted file upload has been identified in Visitor Management System version 1.0, developed by sanjay1313. The issue arises in the files vms/php/admin_user_insert.php and vms/php/update_1.php, where the move_uploaded_file() function is used without any validation of MIME type, file extension, or content. This flaw enables an authenticated admin to upload a PHP web shell through the image upload field, which can then be executed on the server via the URL of the uploaded file.
To address this vulnerability, implement validation for file extensions and MIME types before uploading files. Only allow specific image formats such as JPEG, PNG, and GIF. Additionally, rename uploaded files to prevent overwriting existing files and to avoid using predictable file names.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/menevarad007/CVE-2026-37748 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/menevarad007/CVE-2026-37748 | [email protected] | ExploitThird Party Advisory |
| https://github.com/sanjay1313/Visitor-Management-System | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| sanjay1313 visitor management system | 1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |