Visitor Management System 1.0 by sanjay1313 is vulnerable to Unrestricted File Upload in vms/php/admin_user_insert.php and vms/php/update_1.php. The move_upload…

Visitor Management System 1.0 by sanjay1313 contains an unrestricted file upload vulnerability in admin_user_insert.php and update_1.php files. The move_uploaded_file() function lacks proper validation for MIME type, extension, or content. Authenticated administrators can exploit this weakness to upload PHP webshells. Successful exploitation leads to remote code execution on the affected server. The vulnerability affects two specific PHP files in the VMS application.