Authenticated code execution via unrestricted document upload

Arbitrary file upload in PHP Volunteer Management 1.0.2 allows remote authenticated users to execute PHP code through document uploads. The personal and shared document handlers accept unrestricted file types and store them under the web-accessible mods/documents/uploads/ directory, where the server executes uploaded PHP payloads. Valid credentials are required, but the application ships with a default administrative login; exploitation grants control under the web server account.