CVE-2025-13785: 
PHP vulnerability analysis and mitigation

CVE-2025-13785 is a sensitive data exposure vulnerability in the yungifez Skuul School Management System affecting versions up to and including 2.6.5. The flaw resides in the Image Handler component at the /user/profile endpoint, where the application fails to strip EXIF metadata from uploaded images, allowing authenticated users to retrieve sensitive information embedded in profile photos. It was disclosed publicly on November 30, 2025, with a proof-of-concept published on GitHub. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium), requiring only low-privileged authentication with no user interaction (Feedly, VulDB).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-284 (Improper Access Control). The application accepts image uploads via the /user/profile endpoint and stores and serves the original files without performing any server-side EXIF metadata sanitization. As a result, EXIF data embedded in uploaded images — including GPS coordinates, device make/model, serial numbers, timestamps, and user-defined tags — remains intact and accessible to any user who can retrieve the image URL. Exploitation requires only a valid low-privileged account (student, teacher, parent, admin, or super admin) and network access to the application (GitHub PoC, VulDB).

Successful exploitation allows authenticated low-privileged users to extract sensitive EXIF metadata from profile images uploaded by other users, including precise GPS location coordinates, device make and model, camera serial numbers, photo timestamps, and personal identifiers embedded in image tags. This constitutes a privacy violation that could expose users' physical locations and device information in educational environments, and may result in non-compliance with GDPR or similar data protection regulations. The impact is limited to confidentiality — there is no integrity or availability impact — but location disclosure in a school management context poses meaningful personal safety risks (GitHub PoC, Feedly).

A public proof-of-concept exploit was published on GitHub by researcher Zeeshan Khan (thezeekhan) on November 4, 2025, and referenced in the CVE disclosure on November 30, 2025. Exploitation is straightforward and requires only a valid low-privileged account and access to an online EXIF viewer tool. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.025% (0.000250), indicating low probability of near-term automated exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub PoC, Feedly).

1. Authenticate: Log in to the Skuul School Management System at /login using any valid low-privileged account (student, teacher, parent, admin, or super admin).
2. Prepare a metadata-rich image: Obtain or create a JPEG image containing embedded EXIF metadata, including GPS coordinates and device information (e.g., a sample from https://github.com/ianare/exif-samples/blob/master/jpg/gps/DSCN0010.jpg).
3. Upload the image: Navigate to /user/profile and upload the prepared image as a profile photo. The application stores the file without stripping metadata.
4. Retrieve the image URL: After upload, note or discover the direct URL to the stored profile image of the target user.
5. Extract EXIF metadata: Download the image and analyze it using an online EXIF viewer such as https://www.pic2map.com or https://exif.tools to extract GPS coordinates, device model, timestamps, and other sensitive data (GitHub PoC).

• Network: Repeated HTTP GET requests to profile image URLs (e.g., /storage/profile_photos/ or similar paths) from authenticated users who do not own those profiles; bulk image download activity from a single authenticated session.
• Logs: Web server access logs showing authenticated users accessing image files belonging to other user accounts; unusual patterns of image URL enumeration in application logs.
• File System: Presence of uploaded JPEG files in the profile image storage directory retaining original EXIF metadata (verifiable via exiftool or similar utilities); absence of any EXIF-stripped or sanitized image variants.

No vendor patch is currently available, as the vendor has been unresponsive to the disclosure. As immediate workarounds, administrators should implement server-side EXIF stripping for all uploaded images using libraries such as Intervention/Image (PHP) or equivalent, and restrict direct public access to uploaded image files where possible. Additional recommended steps include: restricting access to the Skuul application to trusted networks only, auditing existing stored profile images and stripping metadata retroactively using tools like exiftool -all= *.jpg, monitoring access logs for unusual image retrieval patterns, and considering temporary disablement of profile photo uploads until a fix is available (GitHub PoC, Feedly).

The vulnerability received automated coverage from CVE tracking accounts on Bluesky (@cve.skyfleet.blue) and X (@CVEnew), as well as indexing by standard vulnerability aggregators including VulDB, Vulners, Tenable, and ENISA's EUVD. No notable independent researcher commentary or vendor statement has been published beyond the original disclosure. The vendor has not responded to the researcher's disclosure attempts (Feedly, VulDB).