| タイトル | phpgurukul Pre-School Enrollment System V1.0 File Deletion |
|---|
| 説明 | During security testing of the Pre-School Enrollment System, a critical file deletion vulnerability was identified in the teacher management module. The system improperly handles user-supplied input in the 'profilepic' parameter when processing delete requests. After authenticating with admin privileges (default credentials: admin/Test@123), an attacker can manipulate this parameter to perform directory traversal attacks. By injecting path traversal sequences (../), attackers can escape the intended directory and delete arbitrary files anywhere on the server where the web application has write permissions. This vulnerability poses significant risk as it could be exploited to delete configuration files, system files, or other critical application components, potentially leading to complete system compromise or service disruption. |
|---|
| ソース | ⚠️ https://github.com/manyufann/CVE/issues/5 |
|---|
| ユーザー | manyufan (UID 87195) |
|---|
| 送信 | 2025年07月03日 11:07 (1 年 ago) |
|---|
| モデレーション | 2025年07月10日 09:20 (7 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 305313 [PHPGurukul Pre-School Enrollment System manage-teachers.php ディレクトリトラバーサル] |
|---|
| ポイント | 0 |
|---|