| शीर्षक | PHPGurukul `Bank Locker Management System (BLMS)` v1.0 Authorization Bypass Through User-Controlled Key |
|---|
| विवरण | An unauthenticated sensitive information disclosure vulnerability exists in `Bank Locker Management System 1.0` in the file `/blms/view-assign-locker.php`. The page lacks any authentication or authorization check, allowing unauthenticated attackers to enumerate customer records by manipulating the `ltid` parameter. Each record exposes the customer's full name, email address, mobile number, complete residential address, occupation, nominee details, declared valuable items, and direct download links to scanned identity documents and personal photographs stored in unprotected web-accessible directories. |
|---|
| स्रोत | ⚠️ https://github.com/wakakakaaaaha/vuln/issues/2 |
|---|
| उपयोगकर्ता | Racosmo (UID 100207) |
|---|
| सबमिशन | 31/07/2026 05:38 PM (1 महीना पहले) |
|---|
| संयम | 12/09/2026 11:31 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403104 [PHPGurukul Bank Locker Management System 1.0 view-assign-locker.php ltid अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|