Executive brief
Skuul is a web-based school management system used to manage student, teacher, and parent accounts and communications. The system fails to strip EXIF metadata from uploaded profile images, allowing attackers to extract sensitive information such as GPS coordinates, device details, and timestamps from any publicly accessible image. This could expose user location data and personal device information, creating privacy violations and potential regulatory compliance issues.
Technical details
Skuul versions up to 2.6.5 contain an information disclosure vulnerability in the image upload handler (/user/profile component). The vulnerability exists because the application accepts and serves uploaded images without removing EXIF metadata, which may contain GPS coordinates, device identifiers, creation timestamps, and other personal data embedded by the camera or device. The attack is remotely accessible to any authenticated user who can access or download profile images; no special privileges are required. An attacker can extract this metadata using standard EXIF viewers to obtain sensitive location and device information about image uploaders. The vendor has not yet released a patch; mitigation requires server-side EXIF stripping during image upload.
Affected products
- yungifez Skuul School Management System up to 2.6.5
Timeline
- 2025-11-04: disclosed: Public disclosure via GitHub Gist by thezeekhan
- 2025-11-30: advisory: CVE-2025-13785 published on NVD