A vulnerability has been discovered in PHPGurukul Online Course Registration up to version 3.1. The flaw resides in the Student Registration component, specifically the edit‑student‑profile.php script. An attacker can supply a specially crafted photo argument that bypasses the application’s file validation logic, allowing the attacker to upload any file type to the server. If the upload is executed in a writable directory that is served by the web server, this enables the attacker to place malicious payloads, potentially leading to remote code execution or further compromise.

Affected products are PHPGurukul Online Course Registration applications that include the Student Registration module. Any installation using versions up to and including 3.1 is potentially vulnerable. The issue originates from the photo argument in /admin/edit‑student‑profile.php. No additional version qualifiers are available beyond the upper bound of 3.1; therefore any deployment within this range should be examined.

The CVSS score of 5.3 reflects moderate impact but the presence of an unrestricted upload elevates the risk when an attacker can supply a web‑accessible persistence script. The EPSS indicates a very low exploitation probability (<1%) at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Despite the low prevalence, the attack can be launched remotely without prior authentication, so an attacker could upload a file that, if executed by the server, would give the attacker control over the application. The exploit is publicized on multiple forums and code repositories, so detection of such uploads should be part of security monitoring.