CVE-2026-90517 Details
Description
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used.
An authorization bypass vulnerability has been identified in PHPGurukul Bank Locker Management System version 1.0. The issue resides in the file '/blms/view-assign-locker.php', where the 'ltid' parameter is manipulated, leading to unauthorized access. This vulnerability allows unauthenticated attackers to remotely access and enumerate customer records, each containing sensitive personal information such as full name, email, mobile number, address, occupation, nominee details, valuable items, and links to unprotected identity documents and personal photos.
To address this vulnerability, implement session authentication checks on the 'view-assign-locker.php' page, restrict access to the 'banker/addressproof/' and 'banker/photo/' directories, use randomized identifiers instead of sequential integers to prevent enumeration, enforce proper authorization checks, and review other files in the public web root for similar issues.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wakakakaaaaha/vuln/issues/2 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://phpgurukul.com/ | [email protected] | ProductVendor |
| https://vuldb.com/cve/CVE-2026-90517 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/912139 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403104 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403104/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PHPGurukul Bank Locker Management System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |