CVE-2026-78245: itsourcecode Online Pharmacy System User Registration register.php move_uploaded_file unrestricted upload
A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function moveuploadedfile of the file allusers/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can launch the attack without authentication or user interaction, according to the supplied vector. The vulnerable functionality is the user-registration photo upload handled by all_users/register.php.
What must an attacker do to exploit it?
The attacker needs to manipulate the photo argument submitted to the registration upload function. This can result in an unrestricted file upload through move_uploaded_file.
Are systems running the identified release exposed?
The issue affects itsourcecode Online Pharmacy System 1.0, specifically the User Registration component's all_users/register.php file. The provided data does not state whether any configuration changes or mitigations prevent exploitation.
How urgent is remediation?
The issue is rated high with a CVSS score of 7.3, and a public exploit has been published that may be used. Prioritize remediation for internet-accessible deployments with the registration endpoint available.