CVE-2026-90519 Details
Description
A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
A vulnerability allowing unrestricted file upload has been identified in PHPGurukul Bank Locker Management System version 1.0. The issue resides in the file '/blms/banker/add-locker-form.php', where the validation for the 'addressproof' file upload is completely disabled. This flaw allows authenticated attackers to upload malicious PHP files disguised as images. Once uploaded, these files can be executed on the server, leading to remote code execution.
To address this vulnerability, the 'addressproof' file validation should be restored and properly implemented. Additionally, uploaded files should be stored outside of the web root or served through a proxy script that enforces download restrictions. Implementing MIME type validation and restricting execution permissions on upload directories can further mitigate the risk.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wakakakaaaaha/vuln/issues/5 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://phpgurukul.com/ | [email protected] | ProductVendor |
| https://vuldb.com/cve/CVE-2026-90519 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/912224 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403106 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403106/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PHPGurukul Bank Locker Management System | 1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |