{"id":"CVE-2025-2687","state":"PUBLISHED","title":"PHPGurukul eLearning System Image index.php unrestricted upload","description":"A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the component Image Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-03-24T06:00:12.375Z","updatedAt":"2025-03-24T12:22:21.869Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["PHPGurukul eLearning System"],"affected":[{"vendor":"PHPGurukul","product":"eLearning System","versions":[{"version":"1.0","status":"affected"}],"modules":["Image Handler"]}],"references":["https://vuldb.com/?id.300708","https://vuldb.com/?ctiid.300708","https://vuldb.com/?submit.521454","https://github.com/ARPANET-cyber/CVE/issues/14","https://phpgurukul.com/"],"weaknesses":["CWE-434","CWE-284"],"ingestedAt":"2026-10-29T20:08:55.257Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/2xxx/CVE-2025-2687.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-2687","state":"PUBLISHED","datePublished":"2025-03-24T06:00:12.375Z","dateUpdated":"2025-03-24T12:22:21.869Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-03-23T09:25:05.701Z"},"containers":{"cna":{"title":"PHPGurukul eLearning System Image index.php unrestricted upload","descriptions":[{"lang":"en","value":"A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the component Image Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"Es wurde eine kritische Schwachstelle in PHPGurukul eLearning System 1.0 entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei /user/index.php der Komponente Image Handler. Dank Manipulation mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"PHPGurukul","product":"eLearning System","versions":[{"version":"1.0","status":"affected"}],"modules":["Image Handler"]}],"references":[{"url":"https://vuldb.com/?id.300708","name":"VDB-300708 | PHPGurukul eLearning System Image index.php unrestricted upload","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.300708","name":"VDB-300708 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.521454","name":"Submit #521454 | PHPGurukul eLearning System V1.0 Unrestricted Upload","tags":["third-party-advisory"]},{"url":"https://github.com/ARPANET-cyber/CVE/issues/14","tags":["exploit","issue-tracking"]},{"url":"https://phpgurukul.com/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","type":"CWE","lang":"en","description":"Unrestricted Upload"}]},{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-03-24T06:00:12.375Z"},"timeline":[{"time":"2025-03-23T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-03-23T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-03-23T10:30:09.000Z","lang":"en","value":"VulDB entry last update"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-24T12:22:06.552305Z","id":"CVE-2025-2687","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-24T12:22:21.869Z"}}]}}}