student-management-system CVE-2026-11474

No special conditions are required for exploitation - the CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms unauthenticated, zero-interaction exploitation against the default configuration of Kushan2k student-management-system. The registration endpoint service/RegisterService.php is publicly accessible by design as part of the application's intended workflow, meaning no privileged access, no specific non-default configuration, and no victim interaction are prerequisites. The sole limiting factors are: (1) the application must be deployed and reachable over the network, and (2) the stimg upload directory must be web-accessible and the web server must be capable of executing PHP files - both of which are default conditions for a PHP application of this type. There is no authentication gate protecting the registration endpoint.

The CVSS 4.0 base score of 5.5 (Medium) is likely an understatement of true operational risk. The vector AV:N/AC:L/AT:N/PR:N/UI:N confirms network-reachable, zero-complexity, unauthenticated exploitation with no user interaction - the most dangerous attack profile possible. The CVSS 4.0 impact components are rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), which appears to reflect a narrow scope evaluation; in practice, CWE-434 on a PHP application almost universally enables webshell deployment and full server-level code execution, suggesting the CVSS impact sub-scores may be conservative. The exploit modifier E:P confirms publicly available exploit code, lowering attacker barrier to entry significantly. No EPSS score was available in the provided data - this is a gap. The absence of KEV listing means confirmed mass exploitation has not been reported to CISA, but the combination of a public exploit, zero-auth network access, and an unresponsive vendor materially elevates real-world risk. This is not a high-CVSS-but-low-real-risk scenario; it is a low-scored vulnerability with disproportionately high exploitation potential due to the nature of unrestricted file upload in PHP.

An unauthenticated remote attacker sends a crafted multipart HTTP POST request to service/RegisterService.php with the stimg field set to a PHP webshell file (e.g., shell.php containing <?php system($_GET['cmd']); ?>). The server stores the file in a web-accessible upload directory without validating its type, and the attacker then directly requests the uploaded file's URL to execute arbitrary OS commands under the web server's process account. A public proof-of-concept for this technique has been released via GitHub issue, making automated or script-kiddie exploitation feasible.