CVE-2021-46013

CRITICAL

Sourcecodester Free school management software 1.0 - RCE

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-46013. PoCs published by fuzzyap1.

AI-analyzed exploit summary This exploit demonstrates an unrestricted file upload vulnerability in Free School Management Software 1.0, allowing an attacker to upload a PHP webshell and achieve remote code execution. The PoC includes a multipart/form-data request to upload a malicious PHP file, which can then be accessed to execute arbitrary commands.

Description

An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "<?php system($_GET["cmd"]); ?>" gets uploaded it is saved into /uploads/exam_question/ directory, and is accessible by all users.

Exploits (1)

exploitdb WORKING POC
by fuzzyap1 · textwebappsphp
https://www.exploit-db.com/exploits/50587

This exploit demonstrates an unrestricted file upload vulnerability in Free School Management Software 1.0, allowing an attacker to upload a PHP webshell and achieve remote code execution. The PoC includes a multipart/form-data request to upload a malicious PHP file, which can then be accessed to execute arbitrary commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Free School Management Software 1.0
Auth required
Prerequisites: Access to the admin panel · Valid session cookie
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://www.exploit-db.com/exploits/50587

Scores

CVSS v3 9.8
EPSS 0.0347
EPSS Percentile 87.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
free_school_management_software_project/free_school_management_software 1.0
Published Jan 18, 2022
Tracked Since Feb 18, 2026