CVE-2025-1588
Published: 23 February 2025
Summary
CVE-2025-1588 is a medium-severity Relative Path Traversal (CWE-23) vulnerability in Phpgurukul Online Nurse Hiring System. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents path traversal exploitation by requiring validation of the profilepic input parameter to block '../' sequences and ensure only expected file paths are processed.
Requires timely identification, reporting, and remediation of the specific path traversal flaw in /admin/manage-nurse.php to eliminate the vulnerability.
Enforces access control policies to restrict unauthorized file read/write operations even if path traversal bypasses initial input handling.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in web app profile pic handling directly enables remote exploitation of public-facing app (T1190) and facilitates web shell deployment via arbitrary file write (T1505.003).
NVD Description
A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/manage-nurse.php. The manipulation of the argument profilepic leads to path traversal: '../filedir'. The attack can be…
more
initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions contradicting vulnerability classes.
Deeper analysisAI
CVE-2025-1588 is a path traversal vulnerability classified as critical in PHPGurukul Online Nurse Hiring System 1.0. It affects unknown code within the file /admin/manage-nurse.php, where manipulation of the profilepic argument enables traversal sequences such as '../filedir'. The issue, associated with CWEs-22, CWE-23, and CWE-24, was published on 2025-02-23 and carries a CVSS v3.1 base score of 6.5.
Remote attackers can exploit this vulnerability without authentication, privileges, or user interaction, requiring only low attack complexity over the network. Exploitation allows limited impacts to integrity (I:L) and availability (A:L), with no confidentiality loss, potentially enabling unauthorized file operations outside the intended directory via the manipulated profilepic parameter.
Advisories from VulDB (ctiid.296572, id.296572, submit.505441) and a GitHub issue (wqywfvc/CVE/issues/16) detail the vulnerability, noting public disclosure of the exploit which may be used by attackers. The vendor site phpgurukul.com is referenced, though specific mitigation or patch details are not outlined in these initial reports; the researcher advisory mentions contradicting vulnerability classes.
Details
- CWE(s)