EUVD-2025-209427
GHSA-92r2-m39q-3xf6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable upload with no user interaction but requiring a low-privileged authenticated account (PR:L); unrestricted upload yields full RCE, so C/I/A all High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page.
AnalysisAI
Unrestricted file upload in PHPGurukul Online Course Registration v3.1 allows an authenticated user to upload a malicious PHP file through the profile picture feature on /my-profile.php, leading to remote code execution on the hosting server. The upload handler fails to validate file type or content, so a low-privileged registered account is enough to plant a web shell. Publicly available exploit code exists (SSVC 'poc') and a Medium write-up documents the technique, though EPSS remains very low (0.02%) and it is not listed in CISA KEV.
Technical ContextAI
The affected application is PHPGurukul Online Course Registration, a PHP/MySQL web application distributed as free source code and typically deployed on Apache with a LAMP stack. The root cause is CWE-94 (Code Injection): the profile-picture upload routine on /my-profile.php does not enforce an allow-list of extensions/MIME types or re-encode the image, so a file with a .php extension and executable PHP payload is stored inside the webroot and served by the PHP interpreter. Because the application saves uploads to a web-accessible directory, the attacker-controlled file becomes directly requestable, converting a file-write primitive into arbitrary server-side code execution. The provided CPE string (cpe:2.3:a:n/a:n/a) is a placeholder and contributes no additional product/version precision.
RemediationAI
No vendor-released patch identified at time of analysis; PHPGurukul has not published a fixed version. As specific compensating controls: enforce a server-side allow-list restricting profile uploads to image extensions (.jpg/.png/.gif) validated by content/magic bytes, not just the client-supplied name or MIME header; rename uploaded files to a random server-generated name and strip the original extension; store uploads outside the webroot or in a directory served with execution disabled (e.g., Apache 'php_admin_flag engine off' or removing PHP handler mappings for the upload path) - trade-off is that images must then be served through a proxy script. Additionally re-encode uploaded images via GD/Imagick to destroy embedded PHP payloads (trade-off: minor CPU cost and metadata loss). Restrict or disable open self-registration to preserve the PR:L barrier, and place the app behind authentication/WAF rules that block requests for .php files under the upload directory. Consult the technical write-up (Medium link above) and NVD entry for exploit details when validating fixes.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today