Executive brief
Phpgurukul Online Course Registration is a web application used for managing student enrollments. A security flaw in the profile management section allows registered students to upload malicious files instead of standard images. An attacker could use this to take full control of the server, steal sensitive student data, or disrupt the registration service.
Technical details
An unrestricted file upload vulnerability exists in Phpgurukul Online Course Registration v3.1 within the /my-profile.php component. The application fails to validate file extensions or MIME types for profile picture uploads, allowing authenticated users (students) to upload PHP scripts (e.g., .php, .phtml). By accessing the uploaded file in the /studentphoto/ directory, an attacker can achieve Remote Code Execution (RCE) via a web shell. This allows for complete system compromise, including unauthorized command execution and data exfiltration. No patch is currently documented in the advisory.
Affected products
- Phpgurukul Online Course Registration 3.1
Timeline
- 2025-05-13: disclosed: Vulnerability details shared on GitHub by researcher
- 2026-04-13: advisory: CVE published to NVD