Security readout for executives and security teams
Plain-English summary
CVE-2026-0577 affects code-projects Online Product Reservation System 1.0. A remotely reachable authenticated user may abuse /handgunner-administrator/prod.php to upload files without proper restrictions. Public exploit material exists, but the provided sources do not show confirmed active exploitation. Treat internet-facing or shared-admin deployments as a timely remediation item.
Executive priority
Prioritize assessment for any internet-facing or production deployment. The issue is moderate severity because authentication is required, but public exploit material raises urgency. If the system is used only in a lab or offline, business risk is lower.
Technical view
The issue is reported as unrestricted upload in /handgunner-administrator/prod.php, mapped to CWE-434 and CWE-284. CVSS v2 is 6.5 with network access, low complexity, and single authentication required. The reported impacts are partial confidentiality, integrity, and availability. Evidence identifies version 1.0 only; no vendor patch is named in the provided sources.
Likely exposure
Exposure is most likely where Online Product Reservation System 1.0 is deployed, reachable over a network, and the administrator area is accessible to authenticated users. Internet-facing installations have higher risk. The sources do not identify other affected versions or products.
Exploitation context
VulDB states the attack can be launched remotely and that exploit material has been published. The CVSS vector indicates authentication is required. KEV is false, and the provided sources do not substantiate active exploitation in the wild.
Researcher notes
Evidence is limited to the public CVE/VulDB record and linked proof-of-concept material. The affected function is described only as unknown functionality in prod.php. No official patch, workaround, or broader version range is provided in the supplied sources.
Mitigation direction
- Check code-projects and VulDB for vendor guidance or a fixed release.
- Restrict access to /handgunner-administrator/ to trusted administrators only.
- Disable or isolate the affected upload functionality if not required.
- Enforce server-side file type, extension, and storage controls.
- Review uploaded files and remove unauthorized content.
- Place uploaded files outside executable web paths where possible.
Validation and detection
- Confirm whether Online Product Reservation System 1.0 is deployed.
- Identify whether /handgunner-administrator/prod.php is reachable.
- Verify the administrator area requires authentication and is not public.
- Review upload handling for allowlists and server-side validation.
- Inspect upload directories for unexpected or executable files.
- Review web and application logs for suspicious upload activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-434: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0577 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR86.4Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
6.5MediumVector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Source materials
- CVE List V5 sourceCVE List V5
- VDB-339461 | code-projects Online Product Reservation System prod.php unrestricted uploadCVE reference · vdb-entry, technical-description
- VDB-339461 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #731015 | code-projects Online Product Reservation system in PHP with source code V1.0 Unrestricted UploadCVE reference · third-party-advisory
- https://github.com/foeCat/CVE/blob/main/OnlineProductReservation_PHP/file_upload_prod.php.mdCVE reference · related, exploit
- https://code-projects.org/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.