| Название | phpgurukul Pre-School Enrollment System V1.0 File Deletion |
|---|
| Описание | During security testing of the Pre-School Enrollment System, a critical file deletion vulnerability was identified in the teacher management module. The system improperly handles user-supplied input in the 'profilepic' parameter when processing delete requests. After authenticating with admin privileges (default credentials: admin/Test@123), an attacker can manipulate this parameter to perform directory traversal attacks. By injecting path traversal sequences (../), attackers can escape the intended directory and delete arbitrary files anywhere on the server where the web application has write permissions. This vulnerability poses significant risk as it could be exploited to delete configuration files, system files, or other critical application components, potentially leading to complete system compromise or service disruption. |
|---|
| Источник | ⚠️ https://github.com/manyufann/CVE/issues/5 |
|---|
| Пользователь | manyufan (UID 87195) |
|---|
| Представление | 03.07.2025 11:07 (1 Год назад) |
|---|
| Модерация | 10.07.2025 09:20 (7 days later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 305313 [PHPGurukul Pre-School Enrollment System manage-teachers.php обход каталога] |
|---|
| Баллы | 0 |
|---|