CVE-2026-90517: PHPGurukul Bank Locker Management System view-assign-locker.php authorization
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the ltid argument sent to /blms/view-assign-locker.php. No privileges or user interaction are required according to the supplied vector.
Who is exposed?
Deployments of PHPGurukul Bank Locker Management System 1.0 that expose the affected /blms/view-assign-locker.php endpoint are potentially exposed. The available data does not identify any configuration prerequisite.
Is public exploit code available?
Yes. The exploit is publicly available and may be used, which increases the likelihood of attempted exploitation.
How can defenders check for possible exploitation?
Review requests to /blms/view-assign-locker.php for ltid parameter values, especially values that may reference locker assignments outside the requesting user's authorization. The provided information does not specify expected ltid formats or logging indicators.