A critical unrestricted file upload vulnerability in the Projectworlds House Rental and Property Listing application enables remote code execution potential due to insufficient file validation.

This vulnerability occurs within the /app/register.php file of the Signup component, where improper access controls and file validation permit unauthenticated users to upload arbitrary files.

The ability for an unauthenticated remote attacker to upload files to the server creates a severe risk of arbitrary code execution, which could lead to a full system compromise. With a CVSS score of 7.3, this high-severity flaw poses a significant threat to data confidentiality and integrity, potentially allowing attackers to gain persistent access to the underlying server infrastructure.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the registration endpoint or disable the registration functionality entirely until a secure update is provided.

Proactive Monitoring: Security teams should monitor web server logs for suspicious file upload requests, particularly those targeting the /app/register.php endpoint, and audit the web root for unauthorized files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads that do not conform to expected file types, sizes, or extensions.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository.

Given the availability of a public proof-of-concept and the high risk associated with unrestricted file uploads, this vulnerability requires immediate attention. Organizations utilizing the affected software must treat this as a priority, implementing strict access controls or disabling the vulnerable component until the vendor releases a formal security patch.