CVE-2025-57148 Details
Description
phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation.
A vulnerability allowing arbitrary file upload has been identified in phpGurukul Online Shopping Portal version 2.0. This issue arises in the admin 'insert-product.php' file, where uploaded files are not properly validated for their extensions. As a result, an admin user can upload malicious files, such as PHP scripts, which could be executed on the server, leading to remote code execution.
To address this vulnerability, implement an extension whitelist to only allow safe file types, such as JPG, PNG, or PDF. Additionally, verify the actual content of uploaded files using MIME type and magic bytes, rather than relying on file extensions, which can be easily spoofed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 3, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://doc.clickup.com/3897127/p/h/3pxt7-12496/7fdf159633a77d1 | [email protected] | ExploitThird Party Advisory |
| https://github.com/hptcybersecurity/CVE/blob/main/CVE-2025-57148.md | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| phpgurukul online shopping portal | 2.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | CVE Modified | [email protected] |
| Sep 4, 2025 | Initial Analysis | [email protected] |
| Sep 3, 2025 | CVE Modified | CISA-ADP |
| Sep 3, 2025 | New CVE Received | [email protected] |