Executive brief
Bank Locker Management System is a web application used to manage bank safety deposit box reservations and customer documentation. The system contains an unrestricted file upload vulnerability in the locker registration form that allows authenticated attackers to upload and execute arbitrary PHP code, leading to complete server compromise and exposure of sensitive customer data including identity documents and banking credentials.
Technical details
An unrestricted file upload vulnerability exists in /blms/banker/add-locker-form.php where the addressproof file upload parameter lacks extension validation (the validation block is commented out in the code), while the photo parameter is properly validated. An authenticated attacker with valid banker or sub-banker credentials can upload a PHP webshell as the addressproof parameter, which is saved with a predictable filename (MD5 hash + timestamp + extension) to the web-accessible /blms/banker/addressproof/ directory. No MIME-type validation or .htaccess restrictions prevent execution. The attacker can then locate the uploaded file by brute-forcing the timestamp and execute arbitrary PHP code with web-server privileges, achieving remote code execution and full system compromise.
Affected products
- PHPGurukul Bank Locker Management System 1.0
Timeline
- 2026-07-31: disclosed
- 2026-09-13: advisory