EUVD-2026-23426
GHSA-x6mf-8rqw-rvhf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This issue affects some unknown processing of the file admin/addteacher.php of the component Background Management Page. The manipulation of the argument image results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unrestricted file upload vulnerability in QueryMine SMS admin panel allows authenticated remote attackers to upload arbitrary files via the image parameter in admin/addteacher.php, potentially enabling remote code execution. Affects all versions up to commit 7ab5a9ea196209611134525ffc18de25c57d9593. Public exploit code exists and the vendor has not responded to disclosure attempts.
Technical ContextAI
QueryMine SMS is a PHP-based school management application. The vulnerability exists in the Background Management Page component, specifically the admin/addteacher.php file, which handles file upload processing. CWE-434 (Unrestricted Upload of File with Dangerous Type) indicates insufficient validation of uploaded file types or content. The image parameter accepts user-supplied input without proper server-side validation (file type checking, extension whitelisting, or content inspection), allowing attackers with authenticated access to bypass intended upload restrictions. CPE cpe:2.3:a:querymine:sms:*:*:*:*:*:*:*:* indicates the entire QueryMine SMS product line is affected, though the product does not use semantic versioning-releases are tracked only by git commit hash.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was contacted early during disclosure but did not respond. For organizations running QueryMine SMS, immediate remediation requires: (1) Restrict network access to the admin/addteacher.php endpoint to trusted internal IP addresses only via firewall rules or web server configuration; (2) Implement application-level file upload validation: enforce strict file type whitelisting (e.g., only .jpg, .png, .gif extensions), validate MIME types server-side (not relying on client headers), and verify actual file content using binary signatures (magic bytes); (3) Store uploaded files outside the web root or in a non-executable directory with explicit denial of script execution (e.g., via .htaccess or nginx config: disable PHP execution in upload directory); (4) Review and audit admin user accounts to remove inactive or unnecessary credentials; (5) Monitor upload directory for unexpected files via file integrity monitoring. If a patched version becomes available from the vendor, upgrade immediately, but currently recommend the above compensating controls as the primary mitigation strategy.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today