CVE-2020-27956

Name of the Vulnerable Software and Affected Versions SourceCodester Car Rental Management System version 1.0

Description The issue allows remote code execution due to an arbitrary file upload vulnerability in the Upload Image component. This is possible because .php files can be uploaded to the admin/assets/uploads/ directory, which is under the web root, via the admin/index.php?page=manage car endpoint.

Recommendations For SourceCodester Car Rental Management System version 1.0, consider restricting access to the Upload Image component to prevent arbitrary file uploads until a patch is available. As a temporary workaround, restrict write access to the admin/assets/uploads/ directory to minimize the risk of exploitation.