Description

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T12:17:16.073Z",
  "pubdate": "2026-09-13T12:17:16.073Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists in the PHPGurukul Bank Locker Management System (BLMS) version 1.0.\nThe flaw resides within the processing logic of the /blms/view-assign-locker.php script, specifically concerning the handling of the ltid argument.\nThis vulnerability allows an unauthenticated or unauthorized remote attacker to bypass access control mechanisms and manipulate or view sensitive locker assignment data.\nThe risk is elevated due to the public availability of exploit code, increasing the likelihood of active exploitation.\nSuccessful exploitation grants the attacker unauthorized access to sensitive financial management data, potentially leading to unauthorized data exposure or administrative manipulation within the system.\nThe vulnerability does not inherently require local access, as it can be initiated remotely via standard HTTP requests.\nImmediate attention is required to secure the affected application component to prevent unauthorized data retrieval and potential system compromise.",
  "technicalDetails": "The vulnerability in PHPGurukul Bank Locker Management System 1.0 is categorized as an authorization bypass, likely stemming from improper server-side validation of user sessions or permissions when processing the ltid (Locker Transaction ID) parameter.\nThe affected file, /blms/view-assign-locker.php, fails to adequately verify if the requesting user possesses the requisite authorization levels or active session tokens before executing operations associated with the provided ltid argument.\nThe attack flow initiates when a remote attacker crafts a malicious HTTP GET or POST request targeting /blms/view-assign-locker.php. By supplying an arbitrary or targeted integer within the ltid parameter, the attacker forces the application to process data associated with that specific transaction identifier without enforcing access control checks.\nBecause the underlying code assumes that the presence of the ltid implies authorization, the application proceeds to render or process backend data that should otherwise remain restricted to administrative users or the authorized locker holder.\nThis behavior is indicative of an Insecure Direct Object Reference (IDOR) pattern or a lack of functional level access control, where the application trusts user-supplied input to perform sensitive operations without secondary validation.\nThe technical impact involves the unauthorized disclosure of private locker assignment details, which may include customer identification, transaction history, and locker status information.\nExploitation does not require elevated privileges or pre-existing session state if the application logic does not strictly validate the user's current authentication status before reaching the vulnerable database query or data processing function.\nThe payload generally involves manipulating the ltid value in the URL string, often iterating through numerical sequences to enumerate locker assignments across the entire system. Because the vulnerability is remotely exploitable and relies on simple parameter tampering, the barrier to entry for an attacker is minimal.\nPost-exploitation, an attacker can harvest sensitive internal data, potentially leading to a broader compromise of the Bank Locker Management System's integrity and confidentiality."
}