EUVD-2025-18923CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Description
PHPGurukul Pre-School Enrollment System Project V1.0 is vulnerable to Directory Traversal in update-class-pic.php.
Analysis
CVE-2025-50348 is a Directory Traversal vulnerability in PHPGurukul Pre-School Enrollment System Project version 1.0, specifically in the update-class-pic.php file. An unauthenticated remote attacker can exploit this vulnerability to read sensitive files from the server, achieving high confidentiality impact without requiring user interaction or special privileges. The vulnerability has a CVSS score of 7.5 (High) with a network-based attack vector and low attack complexity, indicating it is easily exploitable by remote actors; however, exploitation is limited to information disclosure without modification capabilities.
Technical Context
The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, 'Path Traversal'), a common input validation flaw in web applications. The vulnerable component update-class-pic.php likely processes file path parameters (such as image upload/update operations) without proper sanitization or validation. The application fails to implement adequate checks to prevent directory traversal sequences (e.g., '../../../etc/passwd') from being used in file path construction. This is typical in PHP web applications that handle file operations without using secure file handling functions or proper input normalization. The vulnerability affects the PHPGurukul project, which is a PHP-based educational enrollment management system commonly used in small institutions.
Affected Products
- product: PHPGurukul Pre-School Enrollment System Project; vendor: PHPGurukul; version: 1.0; affected_component: update-class-pic.php; vulnerability_type: Directory Traversal; notes: The vulnerability exists in version 1.0; patch status for subsequent versions unknown without vendor advisory reference
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today