A critical remote code execution vulnerability in the Scholars Tracking System allows authenticated users to execute arbitrary PHP code on the host server.

This is an unrestricted file upload vulnerability found in the update_profile_picture.php and upload_picture.php endpoints, which fail to validate file extensions before storing them in a web-accessible directory. An authenticated attacker can leverage this flaw to upload and execute malicious PHP scripts with the privileges of the web server user.

Successful exploitation of this vulnerability leads to full remote code execution, effectively granting an attacker total control over the affected server. Given the CVSS score of 8.8, this poses a high risk of data theft, unauthorized system modification, and potential lateral movement within the network. Organizations relying on this software face significant risks to data integrity and overall system availability.

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the application or disable the profile picture upload functionality.

Proactive Monitoring: Monitor server access logs for requests directed at the /uploads/ directory, specifically looking for attempts to access non-image file extensions like .php or .phtml.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests that attempt to upload files with unauthorized extensions to the specified target endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists, as attributed to the security researcher's technical write-up.

Given the severity of potential remote code execution, it is imperative to treat this vulnerability with high priority. Organizations currently running the Scholars Tracking System should implement strict access controls and monitor for signs of unauthorized file uploads until a formal security update is released by the vendor.