Description
A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Published: 2026-09-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via unrestricted upload
Action: Patch Now
AI Analysis

Impact

The vulnerability in PHPGurukul Bank Locker Management System 1.0, specifically the add-locker-form.php script located under /blms/banker, allows an attacker to upload arbitrary files by manipulating the addressproof argument. The flaw consists of missing file type validation (CWE-434) and absence of an authorization check (CWE-284), enabling uncontrolled file placement on the server. If the uploaded file is executable by the web server, the attacker can achieve remote code execution, compromising confidentiality, integrity, and availability of the application.

Affected Systems

The only affected product is PHPGurukul Bank Locker Management System 1.0; the issue resides in the add-locker-form.php script within this version.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% reflects a low anticipated probability of exploitation in the wild. The vulnerability is not listed Attackers who can reach the /blms/banker/add-locker-form.php endpoint, which may be protected by authentication, can manipulate the addressproof argument to upload arbitrary files; if the server permits execution of the uploaded content, remote code execution becomes possible.

Generated by OpenCVE AI on September 15, 2026 at 17:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest vendor patch or upgrade to a newer version of PHPGurukul Bank Locker Management System that fixes the unrestricted upload flaw.
  • Implement server‑side validation that accepts only allowed file types and rejects all others before storing the file.
  • Store uploaded files in a directory that resides outside the web root and configure file permissions to prevent execution.
  • Disable execution of scripts in the upload directory and, if necessary, use web‑server configuration or .htaccess rules to block MIME type execution.

Generated by OpenCVE AI on September 15, 2026 at 17:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 12:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Title PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload
First Time appeared Phpgurukul
Phpgurukul bank Locker Management System
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:phpgurukul:bank_locker_management_system:*:*:*:*:*:*:*:*
Vendors & Products Phpgurukul
Phpgurukul bank Locker Management System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Phpgurukul Bank Locker Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-15T14:00:13.560Z

Reserved: 2026-09-12T09:31:40.174Z

Link: CVE-2026-90519

cve-icon Vulnrichment

Updated: 2026-09-15T13:42:28.325Z

cve-icon NVD

Status : Deferred

Published: 2026-09-13T13:16:27.697

Modified: 2026-09-15T15:17:28.087

Link: CVE-2026-90519

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T18:00:17Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type