Description

A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-13T13:16:27.697Z",
  "pubdate": "2026-09-13T13:16:27.697Z",
  "executiveSummary": "A critical security vulnerability has been identified in PHPGurukul Bank Locker Management System 1.0, specifically within the /blms/banker/add-locker-form.php component.\nThe vulnerability is classified as an Unrestricted File Upload flaw, which enables remote attackers to inject arbitrary files into the host server.\nThe flaw stems from insufficient validation of the addressproof argument, allowing for the bypass of file type, extension, or content-based security filters.\nSuccessful exploitation grants an attacker the capability to achieve remote code execution (RCE) by uploading malicious scripts (such as web shells), leading to full system compromise.\nThe vulnerability is remotely exploitable without requiring complex conditions, and public exploit code exists, significantly increasing the risk of immediate exploitation.\nThis represents a high-risk security posture, as the application fails to enforce restrictive policies on user-supplied file uploads, compromising the confidentiality, integrity, and availability of the server environment.",
  "technicalDetails": "The vulnerability resides in the /blms/banker/add-locker-form.php file of the PHPGurukul Bank Locker Management System 1.0. The application fails to implement adequate server-side validation for the 'addressproof' input field, which is intended to handle file uploads.\nRoot Cause Analysis: The application lacks a robust file-validation mechanism. It fails to check file extensions against an allowlist, ignores MIME-type verification, and does not sanitize the filename or path. Furthermore, the upload directory likely lacks proper execution restrictions, allowing uploaded files to be treated as executable scripts by the web server.\nAttack Flow: An attacker interacts with the 'add-locker-form.php' script by sending a specially crafted HTTP POST request. By manipulating the 'addressproof' parameter, the attacker can upload a malicious file (e.g., a PHP-based web shell) instead of an expected document. Because the system does not enforce strict checks, the server writes this file to a predictable or discoverable directory on the web server.\nExploitation Method: Once the malicious file is uploaded, the attacker performs a direct request to the file's path via the web browser or a command-line tool. Since the web server is configured to parse PHP, the uploaded malicious code executes within the context of the web application process.\nPost-Exploitation Impact: Upon successful execution, the attacker gains the ability to execute arbitrary system commands, read sensitive database configurations, modify system files, or pivot further into the internal network. This effectively results in full control over the web application environment and potentially the underlying operating system.\nNetwork Exposure and Authentication: The vulnerable endpoint is accessible over the network. Depending on the system configuration, exploitation may be possible by unauthenticated users or those with low-level privileges depending on the specific access control implementation of the 'banker' module in the target environment."
}