CVE-2026-78245: Unrestricted Upload in itsourcecode Online Pharmacy System

The vulnerability CVE-2026-78245 affects itsourcecode Online Pharmacy System version 1.0. The issue is located in the move_uploaded_file function of the all_users/register.php file, specifically in the User Registration component. By manipulating the photo argument, an attacker can perform an unrestricted file upload, potentially allowing arbitrary files to be uploaded to the server. This flaw can be exploited remotely without authentication. The CVSS 4.0 base score is 6.9, indicating a medium severity level. Although an exploit has been published, there is no evidence of widespread exploitation in the wild. No patch or vendor advisory is currently provided.

Successful exploitation allows remote attackers to upload arbitrary files to the server via the photo parameter in the user registration process. This can lead to further compromise depending on the server configuration and the nature of the uploaded files. The vulnerability does not require authentication and has low attack complexity, increasing the risk of exploitation. However, the overall impact is rated medium due to limited information on post-upload consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement strict input validation and file type restrictions on uploaded files, disable execution permissions in upload directories, and monitor for suspicious upload activity related to the photo parameter in the user registration process.