| 제목 | phpgurukul Pre-School Enrollment System V1.0 File Deletion |
|---|
| 설명 | During security testing of the Pre-School Enrollment System, a critical file deletion vulnerability was identified in the teacher management module. The system improperly handles user-supplied input in the 'profilepic' parameter when processing delete requests. After authenticating with admin privileges (default credentials: admin/Test@123), an attacker can manipulate this parameter to perform directory traversal attacks. By injecting path traversal sequences (../), attackers can escape the intended directory and delete arbitrary files anywhere on the server where the web application has write permissions. This vulnerability poses significant risk as it could be exploited to delete configuration files, system files, or other critical application components, potentially leading to complete system compromise or service disruption. |
|---|
| 원천 | ⚠️ https://github.com/manyufann/CVE/issues/5 |
|---|
| 사용자 | manyufan (UID 87195) |
|---|
| 제출 | 2025. 07. 03. AM 11:07 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 07. 10. AM 09:20 (7 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 305313 [PHPGurukul Pre-School Enrollment System manage-teachers.php 디렉토리 순회] |
|---|
| 포인트들 | 0 |
|---|