Executive brief
A security vulnerability exists in the Kushan2k Student Management System, a platform used for managing educational records. An attacker can upload malicious files through the student registration form because the system does not properly verify the type of files being uploaded. This could allow an unauthorized person to take complete control of the server, access sensitive student data, or disrupt school operations.
Technical details
An unrestricted file upload vulnerability exists in Kushan2k student-management-system up to commit f16a4ce. The flaw is located in the 'stimg' parameter handling within 'service/RegisterService.php' and 'controllers/RegisterController.php'. The application fails to validate file extensions or MIME types for student profile images, only checking file size before moving uploads to a web-accessible directory ('public/profiles/'). A remote, unauthenticated attacker can upload a PHP shell and execute arbitrary code by requesting the uploaded file. As of the advisory date, the vendor has not responded to the issue report.
Affected products
- Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a
Timeline
- 2026-05-20: disclosed: Issue reported to the project maintainer on GitHub.
- 2026-06-08: advisory: CVE published by VulDB.