A critical file upload vulnerability in the code-projects Computer Laboratory System 1.0 allows authenticated attackers to execute arbitrary code on the host server.

The application fails to properly validate file types during the avatar upload process, allowing authenticated staff members to upload and execute PHP backdoors. This results in the ability to gain full server permissions via web shell connection tools.

The ability for an attacker to achieve remote code execution poses a severe threat to business operations, as it allows for unauthorized data access, system manipulation, and potential lateral movement within the network. With a CVSS score of 7.3, this vulnerability represents a high risk that could lead to complete loss of confidentiality and integrity of the affected server environment.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the avatar upload feature or disable the affected module entirely.

Proactive Monitoring: Review web server access logs for suspicious requests to directories where uploaded files are stored, particularly looking for requests targeting .php files that appear out of place.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block uploads containing prohibited file extensions or suspicious binary signatures in the avatar update endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher's write-up on GitHub.

Given the high impact of remote code execution, organizations currently running version 1.0 of the Computer Laboratory System must treat this as a priority security risk. Until an official vendor update is released, strict access controls and rigorous monitoring of all file upload activity are essential to prevent unauthorized server compromise.