An authenticated arbitrary file upload vulnerability in QDocs Smart School Management System 7.1 enables remote code execution by allowing attackers to bypass file type restrictions.

This vulnerability is a logic flaw within the media upload component that permits authenticated users, such as those with accountant or admin roles, to upload malicious PHP files by abusing an alternate YouTube URL field. These files are saved to a web-accessible directory, facilitating potential server-side code execution.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the underlying web server. This compromise can lead to full system takeover, unauthorized access to sensitive school records, and potential lateral movement within the network, justifying the high CVSS score of 7.2.

Immediate Action: Restrict access to the media upload functionality to trusted administrators only until a security patch is released by the vendor.

Proactive Monitoring: Review web server access logs for requests targeting media upload directories containing unexpected file extensions, particularly .php files.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block files containing non-media extensions or suspicious content within the upload request parameters.

Public Exploit Available: Yes, a public proof-of-concept exists in a GitHub repository as referenced by the CVE record.

Given the ability for authenticated users to achieve arbitrary code execution, this vulnerability poses a significant risk to the integrity of the management system. Administrators should prioritize identifying and restricting access to the vulnerable upload feature immediately and monitor for any suspicious file uploads until an official patch is provided by QDocs.