CVE-2024-2754 is a Medium severity (CVSS 4.7) unrestricted file upload flaw in SourceCodester Complete E-Commerce Site 1.0, in the /admin/users_photo.php file. The record lists no fixed version. Remove or restrict the admin panel, and do not run this sample application on the public internet.
What's affected
- Product: SourceCodester Complete E-Commerce Site, version 1.0 (the CPE lists the author as donbermoy).
- Affected: 1.0.
- Fixed: none listed in the record.
- Weakness: CWE-434.
- Access needed: a high privilege (administrator) account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
The record says the photo argument of /admin/users_photo.php leads to unrestricted upload, and that the exploit has been disclosed publicly. VulDB tracks it as VDB-257544.
Severity note: VulDB calls the issue critical in its description, while the CVSS base score is 4.7 (Medium). Both appear in the record.
How to check if you're exposed
This is a PHP application, not a package, so there is nothing to check with a package manager.
- Search your web roots for the file:
find /var/www -name users_photo.php(adjust the path for your server). - If it exists, confirm whether the application is version 1.0 by looking at its download notes or source headers.
- Check whether the
/admin/path is reachable from the internet, for example by requesting it from outside your network. - Review the upload directory for files you do not recognise, especially scripts with extensions like php.
What to do now
- Find any deployment of this application, including test and demo copies.
- Block public access to
/admin/with network rules or HTTP authentication at the web server. - Configure the web server so the upload directory cannot execute scripts.
- Review uploaded files and admin accounts for anything unexpected.
- If the app is a sample or training project, take it offline rather than patching it.
Why it matters
Unrestricted file upload means an application accepts a file without checking its type, name or destination well enough. If the uploaded file lands somewhere the server will execute or serve it, the upload becomes a way to run attacker chosen content.
The record scores this lower because the CVSS vector requires elevated privileges, but admin panels get compromised through other routes all the time, and a privileged upload flaw then turns a foothold into code execution.
Sample applications from code sharing sites are often copied into production without a security review. The record offers no fixed version, so the realistic options are to harden the deployment or retire it. The score is Medium because the vector needs a high privilege account, but an unrestricted upload in an admin page is a useful second step for anyone who already has a foothold.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Quick check
Why is this Medium when VulDB says critical?
The CVSS vector requires a high privilege account, which lowers the base score to 4.7. The word critical in the description is VulDB's own label.
Is there a fixed version?
Not in the record. Check the project page for updates before relying on any patch.
Sources
Record references (not all retrievable when we reviewed this post):
- https://github.com/wkeyi0x1/vul-report/issues/4
- https://vuldb.com/?ctiid.257544
- https://vuldb.com/?id.257544
Last reviewed: 19 October 2026.
