CVE-2026-108975: SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload
A security flaw has been discovered in SourceCodester Library Management System 1.0. This vulnerability affects the function moveuploadedfile of the file admin/addadmin.php. Performing a manipulation of the argument image results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely without authentication or user interaction. An attacker can manipulate the image argument handled by admin/add_admin.php to upload unrestricted files.
Is there public exploit information available?
Yes. A public exploit has been released and may be used in attacks.
Which deployment is known to be affected?
The affected product identified in the available information is SourceCodester Library Management System version 1.0. The vulnerable upload handling is in admin/add_admin.php.