External risk intelligence

Sourcecodester Attendance and Payroll System RCE via Photo Upload

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2021-44087

This software is a web-based application designed for payroll and attendance tracking. Such systems are commonly deployed as web interfaces to allow employees or administrators to access the service, making the application's web-facing upload functionality a likely point of exposure to the internet or internal networks.

Remote Code Execution

Attendance And Payroll System Project Attendance And Payroll System

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the Sourcecodester Attendance and Payroll System allows unauthenticated attackers to execute arbitrary code remotely. This occurs by uploading a malicious PHP file disguised as a photo, potentially compromising the system's integrity and the data it manages. The main concern is confirming relevance and exposure for this type of business system.

System allows remote code execution via photo upload.
Critical vulnerability impacts business-critical payroll data.
Confirm if this system is used and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by uploading a malicious PHP file disguised as an image through the system's photo upload feature. This could allow the attacker to execute arbitrary code on the server, potentially leading to a complete system compromise.

No authentication required to access.
Triggered by uploading a crafted PHP file.
Enables remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload malicious PHP code through the photo upload feature, potentially leading to the execution of arbitrary code on the server. This could affect system integrity and data confidentiality.

Server-side code execution.
Via crafted photo uploads.
Compromised system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers can exploit this critical vulnerability to execute remote code by uploading a malicious PHP file through the photo upload feature in Sourcecodester Attendance and Payroll System. Identifying all instances of this application, determining their network exposure and business criticality, and locating the accountable owner are the initial steps. Remediation planning should then proceed based on the assessed risk.

Application owners should manage the issue.
Verify network exposure and asset criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sourcecodester Attendance and Payroll System?

It is a web-based software application used to manage employee attendance tracking and payroll processing. Organizations deploy it as a server-side interface where administrators or staff interact with these records. Because it handles sensitive workforce data, it is typically hosted on a web server that communicates over a network.

What does this CVE-2021-44087 vulnerability actually mean?

This is a remote code execution weakness. It means the application fails to properly restrict the types of files users can upload. An attacker can send a script file, masquerading as a standard image, to the server. If the server processes this file, it inadvertently runs the attacker's code, granting them control over the system.

How does an attacker trigger this vulnerability?

The attack occurs by accessing the application's photo upload feature and submitting a file containing malicious PHP code instead of a valid image. The vulnerability does not trigger if the application is configured to strictly validate file headers or types, nor does it affect standard image files that do not contain executable scripts.

Is my instance of the system at risk?

Halo Surface Signal indicates this application is often deployed as a web interface, making its upload functionality a likely point of exposure. If your instance is reachable from the internet or exposed across broad internal network segments, it is at higher risk. You should verify where this software is hosted to determine if it is accessible to unauthorized users.

What should I do if I am running this software?

First, locate all running instances of the application and identify the internal owner responsible for them. Assess whether these systems are exposed to your network and evaluate the sensitivity of the payroll data they hold. Coordinate with your technical team to prioritize these assets for remediation based on your internal risk management procedures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.