CVE-2025-2687
Published: 24 March 2025
Summary
CVE-2025-2687 is a medium-severity Improper Access Control (CWE-284) vulnerability in Phpgurukul Elearning System. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Ingress Tool Transfer (T1105); ranked at the 21.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-2687 is a critical vulnerability in PHPGurukul eLearning System 1.0, affecting an unknown function in the file /user/index.php of the Image Handler component. The issue enables unrestricted file upload through manipulation of this endpoint.
The vulnerability can be exploited remotely by attackers with low privileges (PR:L), requiring low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L) with unchanged scope (S:U), as reflected in its CVSS v3.1 base score of 6.3 (AV:N). The exploit has been publicly disclosed and may be used, with associated weaknesses in CWE-284 (Improper Access Control) and CWE-434 (Unrestricted Upload of File with Dangerous Type).
Advisories and details are available via references including a GitHub issue at https://github.com/ARPANET-cyber/CVE/issues/14, the vendor site at https://phpgurukul.com/, and VulDB entries at https://vuldb.com/?ctiid.300708, https://vuldb.com/?id.300708, and https://vuldb.com/?submit.521454. The vulnerability was published on 2025-03-24.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-15102
Vulnerability details
A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the component Image Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack…
more
remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted file upload vulnerability in public-facing PHP web application enables remote exploitation for initial access (T1190), ingress tool/malware transfer (T1105), and web shell deployment/execution (T1505.003).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates unrestricted file upload by requiring validation of inputs to the image handler, preventing acceptance of dangerous file types.
Enforces proper access control on the /user/index.php endpoint, addressing CWE-284 improper access control that enables remote manipulation.
Remediates the specific flaw in the image handler component through identification, reporting, and correction of the unrestricted upload vulnerability.