Unrestricted File Upload in Student Management System Registration

A security flaw has been discovered in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected is an unknown function of the file service/RegisterService.php of the component Registration Endpoint. Performing a manipulation of the argument stimg results in unrestricted upload. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-11474 is a critical unrestricted file upload vulnerability affecting Kushan2k's student-management-system through its Registration Endpoint. An attacker can manipulate the 'stimg' parameter in the RegisterService.php component to upload arbitrary files without proper validation or restrictions. This vulnerability carries a CVSS score of 7.3 and impacts educational institutions, administrators, and students relying on this platform for enrollment and registration workflows. The public exploit availability and rolling release model create an urgent patch management challenge for affected organizations.

Casky.ai's 419 mapped security skills detect the attack patterns underlying this vulnerability by analyzing the MITRE ATT&CK techniques: Initial Access (TA0001) focuses on how attackers exploit the registration endpoint as an entry point; Execution (TA0002) identifies the file upload mechanism being abused; and Defense Evasion (TA0043) detects how arbitrary file uploads bypass security controls. Practitioners using Casky would see findings highlighting improper input validation on file parameters, missing file type restrictions, and absence of upload directory isolation. Claude's extended reasoning capabilities correlate these signals across multiple security skills to surface the complete attack chain: reconnaissance of the vulnerable endpoint, exploitation through parameter manipulation, and post-exploitation file execution potential—enabling practitioners to implement compensating controls and prioritize remediation efforts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-11474.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-11474

Casky has 419 skills that investigate the attack patterns behind CVE-2026-11474. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn