| Title | phpgurukul Pre-School Enrollment System V1.0 File Deletion |
|---|
| Description | During security testing of the Pre-School Enrollment System, a critical file deletion vulnerability was identified in the teacher management module. The system improperly handles user-supplied input in the 'profilepic' parameter when processing delete requests. After authenticating with admin privileges (default credentials: admin/Test@123), an attacker can manipulate this parameter to perform directory traversal attacks. By injecting path traversal sequences (../), attackers can escape the intended directory and delete arbitrary files anywhere on the server where the web application has write permissions. This vulnerability poses significant risk as it could be exploited to delete configuration files, system files, or other critical application components, potentially leading to complete system compromise or service disruption. |
|---|
| Source | ⚠️ https://github.com/manyufann/CVE/issues/5 |
|---|
| User | manyufan (UID 87195) |
|---|
| Submission | 07/03/2025 11:07 (1 Year ago) |
|---|
| Moderation | 07/10/2025 09:20 (7 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 305313 [PHPGurukul Pre-School Enrollment System manage-teachers.php path traversal] |
|---|
| Points | 0 |
|---|