CVE-2023-3187

MEDIUM

PHPGurukul Teachers Record Management System 1.0 - Unrestricted Upload

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2023-3187. PoCs published by AFFAN AHMED.

AI-analyzed exploit summary This exploit demonstrates a file upload vulnerability in Teachers Record Management System 1.0, where a malicious PHP file disguised as a GIF (via magic bytes and a double extension) bypasses server-side validation, leading to remote code execution (RCE). The PoC includes a crafted Burp Suite request with a PHP payload embedded in a GIF file.

Description

A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231176.

Exploits (1)

exploitdb WORKING POC
by AFFAN AHMED · textwebappsphp
https://www.exploit-db.com/exploits/51512

This exploit demonstrates a file upload vulnerability in Teachers Record Management System 1.0, where a malicious PHP file disguised as a GIF (via magic bytes and a double extension) bypasses server-side validation, leading to remote code execution (RCE). The PoC includes a crafted Burp Suite request with a PHP payload embedded in a GIF file.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Teachers Record Management System 1.0
Auth required
Prerequisites: Valid teacher account credentials · Access to the profile image upload functionality · Burp Suite or similar intercepting proxy
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.231176
Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.231176

Scores

CVSS v3 6.3
EPSS 0.0256
EPSS Percentile 83.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

CWE
CWE-434
Status published
Products (1)
teachers_record_management_system_project/teachers_record_management_system 1.0
Published Jun 09, 2023
Tracked Since Feb 18, 2026