CVE-2026-122047: Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload
A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function moveuploadedfile of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is remotely exploitable and requires no privileges or user interaction. An attacker can target an accessible instance of Campcodes Complete Advance Loan Management System 1.0.
What component should be investigated?
The affected upload handling is in /loan/application/banner.php, specifically its use of move_uploaded_file with the image argument. Review this endpoint for uploaded files and any resulting unexpected file placement or execution.
How urgent is remediation?
The issue is rated medium severity with a 5.5 score, but public exploit disclosure is noted. Prioritize validation and remediation for internet-accessible deployments because exploitation may be attempted remotely.