CVE-2025-2090: Pre-school Enrollment System Auth Bypass

CVE-2025-2090 Overview

CVE-2025-2090 is an improper access control vulnerability [CWE-266] in PHPGurukul Pre-School Enrollment System 1.0. The flaw resides in the /admin/add-subadmin.php file, part of the Sub Admin Handler component. An authenticated attacker can manipulate the endpoint to bypass access restrictions and perform sub-admin management actions that should be limited to higher-privilege users. The exploit has been publicly disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The vulnerability is remotely exploitable over the network and does not require user interaction.

Critical Impact
Authenticated attackers can exploit weak access controls in the Sub Admin Handler to elevate privileges or create unauthorized sub-admin accounts on affected deployments.

Affected Products

PHPGurukul Pre-School Enrollment System 1.0
Component: Sub Admin Handler (/admin/add-subadmin.php)
CPE: cpe:2.3:a:phpgurukul:pre-school_enrollment_system:1.0

Discovery Timeline

2025-03-07 - CVE-2025-2090 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2090

Vulnerability Analysis

The vulnerability affects the sub-admin creation workflow exposed by /admin/add-subadmin.php in PHPGurukul Pre-School Enrollment System 1.0. The endpoint fails to enforce role-based checks before processing requests that create or modify sub-admin accounts. Any authenticated session capable of reaching the admin path can trigger sub-admin management functionality that should be restricted to full administrators.

Because the flaw is classified under [CWE-266] Incorrect Privilege Assignment, exploitation results in the attacker obtaining or granting privileges beyond their intended role. The remote attack vector means the endpoint can be reached across the network wherever the application is exposed.

Root Cause

The root cause is missing or insufficient authorization enforcement on the add-subadmin.php handler. The application relies on client-side navigation or session presence rather than validating the acting user's role server-side before executing privileged actions. Reference details are tracked in VulDB #298904 and GitHub CVE Issue #3.

Attack Vector

An attacker with a low-privilege authenticated session sends crafted HTTP requests to /admin/add-subadmin.php. Because the handler does not validate role membership, the request is processed and a new sub-admin account is provisioned or an existing account is altered. The publicly disclosed exploit lowers the skill barrier for adversaries targeting internet-facing deployments.

No verified proof-of-concept code is republished here. See the VulDB CTI entry for the disclosure details.

Detection Methods for CVE-2025-2090

Indicators of Compromise

Unexpected POST requests to /admin/add-subadmin.php originating from non-administrator user sessions or unfamiliar IP addresses.
Newly created sub-admin accounts in the application database that do not correspond to legitimate administrative provisioning activity.
Web server access logs showing successful 200 responses to add-subadmin.php outside of normal administrator working hours.

Detection Strategies

Correlate authenticated session identifiers with the roles assigned to accounts making requests to admin paths and alert on mismatches.
Monitor application audit trails for privilege changes and sub-admin creation events that lack a corresponding administrator-initiated workflow.
Deploy a web application firewall rule that requires additional context validation for requests targeting the /admin/ directory.

Monitoring Recommendations

Ingest PHP application and web server logs into a centralized analytics platform for continuous review of admin-endpoint access patterns.
Baseline normal sub-admin management activity and generate alerts on deviations in request volume, source, or timing.
Track outbound activity from the web host for signs of follow-on abuse if a sub-admin account is created without authorization.

How to Mitigate CVE-2025-2090

Immediate Actions Required

Restrict access to the /admin/ directory using network-level controls, IP allowlisting, or VPN gating until a vendor patch is applied.
Audit existing sub-admin and administrator accounts and remove any that cannot be tied to a documented business owner.
Enforce strong, unique credentials and enable session timeouts to reduce the value of any low-privilege account that could be leveraged.

Patch Information

No vendor advisory or patched release has been published for PHPGurukul Pre-School Enrollment System 1.0 at the time of NVD publication. Track updates on the PHP Gurukul site and the VulDB entry for remediation guidance. Until a fix is available, operators should apply the compensating controls listed below.

Workarounds

Add a server-side authorization check in add-subadmin.php that validates the current session's role before executing any account modification logic.
Place the application behind a reverse proxy that enforces authentication and role attestation for /admin/ paths.
Disable public exposure of the administrative interface and require it to be reached only from trusted internal networks.

bash

# Example nginx configuration restricting admin paths to a trusted management network
location /admin/ {
    allow 10.10.0.0/24;   # trusted admin subnet
    deny  all;
    proxy_pass http://php_backend;
}