phpgurukul News Portal Arbitrary File Deletion Vulnerability

An arbitrary file deletion vulnerability has been identified in phpGurukul News Portal Project version 4.1, specifically within the remove_file.php script. The vulnerability arises because the 'file' parameter can be manipulated to delete any file on the server. This issue does not require user authentication, allowing attackers to exploit it freely.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of files on the server, which could disrupt or crash the business system.

Reproduction

To reproduce this vulnerability, send a POST request to '/plugins/jquery.filer/php/remove_file.php' with the 'file' parameter set to a file path that points to a file within the server's directory structure, such as a text file created in the root directory.