PT-2025-44748 · Phpgurukul · Phpgurukul News Portal

Nishant_Kumar · Published 2025-11-03 · Updated 2025-11-10 · CVE-2025-12615

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPGurukul News Portal version 1.0

Description A security issue exists in PHPGurukul News Portal. Manipulation of the SECRET KEY argument within an unknown function in the /onps/settings.py file results in the use of a hard-coded cryptographic key. This attack can be performed remotely and is considered difficult to exploit, but the exploit has been publicly disclosed.

Recommendations Versions prior to 1.0 should be updated. As a temporary workaround, restrict access to the /onps/settings.py file to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

CVE-2025-12615

Affected Products

Phpgurukul News Portal

References · 10

• 🔥 https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Hard-coded%20Cryptographic%20Key.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-12615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12615 · Security Note
• https://t.me/cveNotify/142299 · Telegram Post
• https://vuldb.com/?ctiid.330909 · Note
• https://phpgurukul.com · Note
• https://t.me/CVEtracker/36400 · Telegram Post
• https://t.me/cveNotify/141283 · Telegram Post
• https://vuldb.com/?submit.678625 · Note
• https://vuldb.com/?id.330909 · Note