| عنوان | phpgurukul Pre-School Enrollment System V1.0 File Deletion |
|---|
| الوصف | During security testing of the Pre-School Enrollment System, a critical file deletion vulnerability was identified in the teacher management module. The system improperly handles user-supplied input in the 'profilepic' parameter when processing delete requests. After authenticating with admin privileges (default credentials: admin/Test@123), an attacker can manipulate this parameter to perform directory traversal attacks. By injecting path traversal sequences (../), attackers can escape the intended directory and delete arbitrary files anywhere on the server where the web application has write permissions. This vulnerability poses significant risk as it could be exploited to delete configuration files, system files, or other critical application components, potentially leading to complete system compromise or service disruption. |
|---|
| المصدر | ⚠️ https://github.com/manyufann/CVE/issues/5 |
|---|
| المستخدم | manyufan (UID 87195) |
|---|
| ارسال | 03/07/2025 11:07 AM (1 سنة منذ) |
|---|
| الاعتدال | 10/07/2025 09:20 AM (7 days later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 305313 [PHPGurukul Pre-School Enrollment System manage-teachers.php اجتياز الدليل] |
|---|
| النقاط | 0 |
|---|