The vulnerability CVE-2026-78245 affects itsourcecode Online Pharmacy System 1.0. It is caused by insufficient validation in the move_uploaded_file function within the user registration script (all_users/register.php). Attackers can exploit this by manipulating the photo parameter to upload files without restriction, potentially leading to unauthorized file uploads on the server. The vulnerability can be exploited remotely without authentication. Although an exploit has been published, there is no indication of widespread exploitation. No official fix or patch has been disclosed by the vendor as of the publication date.

Successful exploitation of this vulnerability allows remote attackers to upload arbitrary files to the server, which could lead to further compromise depending on the file type and server configuration. This may enable unauthorized code execution or defacement. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, no required privileges or user interaction, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement strict server-side validation of uploaded files, restrict allowed file types and sizes, and monitor upload directories for suspicious files. Consider disabling file uploads if not essential. No vendor-provided mitigation or official fix has been published at this time.