CVE-2024-1875 is a medium severity (CVSS 6.3) unrestricted file upload flaw in Complaint Management System version 1.0 from SourceCodester. It affects the complaint submission page. The record names no fixed version, so check the project page, patch the code yourself, or retire the application.
What's affected
Complaint Management System version 1.0, from SourceCodester. The record lists version 1.0 only, and does not name any newer or patched release.
The description puts the flaw in users/register-complaint.php, in the Lodge Complaint section. A write-up linked from the record is titled as remote code execution through unrestricted file upload. The weakness is CWE-434, unrestricted file upload. The description says the attack can be launched remotely and that the exploit has been disclosed publicly and may be used.
Severity conflict. The description text, which follows the VulDB style, calls this issue critical. NVD's own CVSS 3.1 score is 6.3, which is Medium, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. Both ratings are published. The vector requires low privileges, meaning a normal user account is enough.
How to check if you're exposed
Start by finding the install and the upload folder, then look at what is stored there:
find /var/www/html -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -path "*upload*" 2>/dev/null
Script files inside an upload directory are a red flag, because users should be uploading images, not code. If you find any you did not place there, treat the server as possibly compromised and investigate before you patch.
Also check how the web server treats that folder. If it can execute PHP from the upload path, the weakness is much more dangerous than if it can only serve static files. Review your access logs for requests to files in that folder with unusual extensions.
What to do now
- Decide whether you actually run this application. If it is unused or a demo, take it offline and delete it.
- Look in the upload directory for script files and anything you do not recognise. If you find some, isolate the host and investigate first.
- Configure the web server so the upload directory cannot execute scripts, for example by disabling PHP handling for that path.
- Restrict uploads to an allowlist of image types, check content as well as extension, and rename files on save.
- Check the project page for a fixed release. The record names none, so plan to patch the code yourself or replace the application.
Why it matters
Unrestricted upload bugs let a user put a file on the server that the developer never intended. When the file is a script and the server will run it from the upload folder, the result is code execution under the web server account. When uploads are only served as static content, the risk is smaller but includes stored cross site scripting and disk exhaustion.
Because the vulnerable page is the one ordinary users use to lodge complaints, any registered user can reach it. A linked write-up describes code execution through this upload. The safe design is to check the file against an allowlist of types, rename it on save, store it outside the web root or on a host that cannot run scripts, and require an authorised user.
The record's Known Exploited Vulnerabilities flag is false. The description says the exploit has been disclosed publicly and may be used.
Quick check
Who can reach the page?
Per the vector, an attacker needs low privileges, so any registered user of the application qualifies.
Is the vendor name correct?
The record lists the product as SourceCodester Complaint Management System, with razormist as the CPE vendor.
Sources
- NVD record for CVE-2024-1875
- VulDB entry 254723 (listed in the record, not retrievable when reviewed)
- Write-up listed in the record (not retrievable when reviewed)
Last reviewed: 19 October 2026.
