Path Traversal Vulnerability in SourceCodester SRMS

The Munyweki Student Result Management System (SRMS) version 1.0 is susceptible to a path traversal vulnerability identified as CVE-2025-4720. The vulnerability exists within the academic/core/drop_student.php script, which processes user-controlled input from the img GET parameter. The application fails to sanitize this input before passing it to the PHP unlink() function. Consequently, an authenticated attacker can traverse the file system by providing directory traversal sequences (e.g., ../) in the parameter, leading to the unauthorized deletion of arbitrary files located on the server. The lack of validation on the img input makes the system highly vulnerable to destructive actions if an attacker gains authenticated access.

Attack Chain

1. Attacker performs reconnaissance to identify the presence of the SRMS 1.0 application.
2. Attacker obtains valid credentials to authenticate to the SRMS platform.
3. Attacker navigates to the academic/core/drop_student.php administrative function.
4. Attacker crafts a malicious GET request containing a path traversal payload in the img parameter (e.g., ?img=../../../../config.php).
5. The server-side script receives the payload and directly passes the unsanitized string to the unlink() function.
6. The unlink() function executes the deletion against the resolved file path on the web server.
7. Targeted system files are deleted, potentially causing denial of service or configuration loss.

Impact

Successful exploitation of CVE-2025-4720 allows an authenticated attacker to delete arbitrary files on the underlying web server. This could result in the destruction of critical application configuration files, database backups, or core system files, leading to a complete denial of service of the Student Result Management System.

Recommendation

Prioritized actions for detection and remediation:

• Deploy the provided Sigma rule to monitor for suspicious path traversal patterns in web server logs targeting drop_student.php.
• Review web server access logs for any requests to drop_student.php containing ../ sequences in the img query parameter.
• Audit the file system permissions of the web application directory to ensure the web server service account has the minimum necessary privileges to prevent unauthorized file deletion.
• Patch or disable the vulnerable academic/core/drop_student.php component if it is not strictly required for business operations.