CVE-2025-69992

The upload.php endpoint does not require authentication nor verify the format or extension of the uploaded file. An attacker can send an HTTP request to upload.php without logging in with an attached file of any format, including executable scripts (e.g., PHP webshell). After uploading the file to the server, the attacker can access its URL path and remotely execute the code contained within it in the context of the web server.

An attacker can gain full control over the server by executing arbitrary code (RCE), leading to violations of confidentiality, integrity, and availability of the system — including data theft, modification of portal content, or complete server takeover.

Apply patches available from the vendor according to references. Temporarily, it is recommended to: disable or secure the upload.php endpoint with an authentication mechanism, implement a whitelist of allowed file extensions, configure the web server to not execute scripts in directories designated for file uploads.

Phpgurukul News Portal Project version V4.1