A critical unrestricted file upload vulnerability in the 1000projects Online Student Project Report Submission and Evaluation System allows remote attackers to execute malicious file uploads.

The application is susceptible to an unrestricted file upload vulnerability within the /admin/controller/faculty_controller.php file, which can be exploited by an unauthenticated remote attacker by manipulating the new_image argument.

Successful exploitation of this vulnerability permits unauthorized file uploads to the server, which can lead to remote code execution or complete system compromise depending on the server configuration. While the CVSS score of 7.3 indicates a High severity, the ability for an unauthenticated attacker to inject arbitrary files poses a significant risk to the integrity and availability of the host infrastructure.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin directory and ensure that the application is not accessible from the public internet.

Proactive Monitoring: Monitor server logs for unusual file upload activity or requests directed at the /admin/controller/faculty_controller.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing suspicious file extensions or malicious payloads targeting the upload functionality.

Public Exploit Available: Yes, a public proof of concept has been published via the referenced GitHub repository.

Given the availability of a public proof of concept and the nature of the flaw, this vulnerability presents a high risk to the environment. IT teams should prioritize isolating the affected system from external networks and implement strict file validation controls until a vendor-provided update is released to address the underlying security flaw.