Online_ambulance_booking_service v1.0.2 has a getshell vulnerability

[httpshttpxv]

Source code name：online_ambulance_booking_service
Source code version：v1.0.2

Vulnerability description
There is no restriction on uploading imgages on this page, which leads to uploading webshell
Related pages changeimage1.php,.......,changeimage5.php

Code audit

There is no restriction on uploading imgages on this page
Upload path /img/vehicleimages,not change imgage name

Vulnerability verification
Open http://localhost/online/admin/changeimage1.php
Upload trojans
http://localhost/online/admin/img/vehicleimages/get.php getshell