Student-Management-System CVE-2026-18927

Exploitation requires a valid authenticated session with at minimum student-level (low-privilege) access to the application - PR:L per the CVSS 4.0 vector confirms authentication is required. The vulnerability is specifically triggered through the profile picture upload workflow in student_profile_pic.php using the choose_file parameter; no other special configuration is required beyond a functioning upload directory writable by the web server. Exploitation to RCE further depends on the web server being configured to execute PHP files in the upload destination directory, which is the common default for PHP applications that store user uploads under the web root without an execution restriction. Limiting factors: an attacker must first obtain a student account (either through open registration or credential theft); the RCE step fails if uploaded files are stored outside the web root or the upload directory is configured as PHP-execution-disabled.

The vendor-supplied CVSS 4.0 score of 2.1 with all-Low impact metrics (VC:L/VI:L/VA:L) significantly understates real-world risk for this class of vulnerability. CWE-434 in a PHP application where uploads are web-accessible is a well-established RCE primitive - the low impact scores do not account for the post-upload execution step that elevates this to full system compromise. The CVSS 4.0 vector's E:P (proof-of-concept exploit) modifier confirms public exploit code exists, which lowers attacker skill requirement. The vulnerability is not in CISA KEV, and EPSS data was not provided, so widespread automated exploitation is not confirmed; however, the public PoC on GitHub and the lack of vendor response materially elevate real-world priority. The primary limiting factor - requiring a student-level authenticated session (PR:L) - reduces opportunistic attack surface compared to unauthenticated flaws, but any account registration or credential theft bypasses this control. No patch is available and the vendor is unresponsive, making compensating controls the only near-term remediation path.

An attacker registers or obtains a student account on a publicly accessible deployment of the Student-Management-System. They navigate to the profile picture upload feature and submit a crafted HTTP POST request to student_profile_pic.php with a PHP webshell as the choose_file payload, bypassing the absent server-side validation. The attacker then requests the stored file's URL directly, causing the web server to execute the PHP shell and granting arbitrary command execution as the web server process user. A public proof-of-concept demonstrating this flow is available at https://github.com/sanjibsajid381-ctrl/My-Web-cve/issues/1.