SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.
**Describe the bug**
When a user uploads an image in "SLiMS 9 Bulian official source code", the uploaded image’s EXIF Geolocation Data does not gets stripped. As a result, anyone can get sensitive information of "SLiMS 9 Bulian official source code" users like their Geolocation, their Device information like Device Name, Version, Software & Software version used etc.

**CMS Version:**
v9.5.2

**Affected URL:**
http://127.0.0.1/bulian/admin/index.php?mod=membership

**To Reproduce**
Steps to reproduce the behavior:
1) Got to Github ( https://github.com/ianare/exif-samples/tree/master/jpg)
2) There are lot of images having resolutions (i.e 1280 * 720 ) , and also whith different MB’s .
login your admin panel and membership menu and upload photo in any member profile.
3) see the path of uploaded image ( Either by right click on image then copy image address OR right click, inspect the image, the URL will come in the inspect , edit it as html )
4) open it (https://www.verexif.com/en/index.php)
5) See whether is that still showing exif data , if it is then Report it.

**Proof Of Concept:**
You can see the Proof of Concept. which I've attached screenshots and video to confirm the vulnerability.

**Screenshots**
![screenshot1](https://user-images.githubusercontent.com/41516016/229643111-faa0574b-9aa0-4b03-a0d0-da0f7f18e3a1.png)
![screenshot2](https://user-images.githubusercontent.com/41516016/229643122-6698a566-4d72-4b66-b5c5-ede2aedf76d4.png)
![screenshot_2](https://user-images.githubusercontent.com/41516016/229643136-7eefeefc-0bb8-4797-9a2a-5a707157152b.png)
![screenshot3](https://user-images.githubusercontent.com/41516016/229643152-df7cbe53-8070-4735-ba9e-3707f6b3f5a2.png)

**Video**

https://user-images.githubusercontent.com/41516016/229643735-dd78ced5-558d-4817-a6a9-9d34099223d0.mp4




**Desktop (please complete the following information):**
 - OS: Windows 10
 - Browser: Google Chrome
 - 

**Impact**
This vulnerability is CRITICAL and impacts all the "SLiMS 9 Bulian official source code" customer base. This vulnerability violates the privacy of a User and shares sensitive information of the user who uploads an image on SLiMS 9 Bulian official.

Let me know if any further info is required.

Thanks & Regards
**Rahad Chowdhury**
Cyber Security Specialist
https://www.linkedin.com/in/rahadchowdhury

EXIF Geolocation Data Not Stripped From Uploaded Images
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : EXIF Geolocation Data Not Stripped From Uploaded Images
Issue date:

--- start body ---
**Describe the bug**
When a user uploads an image in "SLiMS 9 Bulian official source code", the uploaded image’s EXIF Geolocation Data does not gets stripped. As a result, anyone can get sensitive information of "SLiMS 9 Bulian official source code" users like their Geolocation, their Device information like Device Name, Version, Software & Software version used etc.

**CMS Version:**
v9.5.2

**Affected URL:**
http://127.0.0.1/bulian/admin/index.php?mod=membership

**To Reproduce**
Steps to reproduce the behavior:
1) Got to Github ( https://github.com/ianare/exif-samples/tree/master/jpg)
2) There are lot of images having resolutions (i.e 1280 * 720 ) , and also whith different MB’s .
login your admin panel and membership menu and upload photo in any member profile.
3) see the path of uploaded image ( Either by right click on image then copy image address OR right click, inspect the image, the URL will come in the inspect , edit it as html )
4) open it (https://www.verexif.com/en/index.php)
5) See whether is that still showing exif data , if it is then Report it.

**Proof Of Concept:**
You can see the Proof of Concept. which I've attached screenshots and video to confirm the vulnerability.

**Screenshots**
![screenshot1](https://user-images.githubusercontent.com/41516016/229643111-faa0574b-9aa0-4b03-a0d0-da0f7f18e3a1.png)
![screenshot2](https://user-images.githubusercontent.com/41516016/229643122-6698a566-4d72-4b66-b5c5-ede2aedf76d4.png)
![screenshot_2](https://user-images.githubusercontent.com/41516016/229643136-7eefeefc-0bb8-4797-9a2a-5a707157152b.png)
![screenshot3](https://user-images.githubusercontent.com/41516016/229643152-df7cbe53-8070-4735-ba9e-3707f6b3f5a2.png)

**Video**

https://user-images.githubusercontent.com/41516016/229643735-dd78ced5-558d-4817-a6a9-9d34099223d0.mp4




**Desktop (please complete the following information):**
 - OS: Windows 10
 - Browser: Google Chrome
 - 

**Impact**
This vulnerability is CRITICAL and impacts all the "SLiMS 9 Bulian official source code" customer base. This vulnerability violates the privacy of a User and shares sensitive information of the user who uploads an image on SLiMS 9 Bulian official.

Let me know if any further info is required.

Thanks & Regards
**Rahad Chowdhury**
Cyber Security Specialist
https://www.linkedin.com/in/rahadchowdhury

--- end body ---

The application does not strip EXIF Geolocation Data from uploaded images, which can expose sensitive user information such as location and device details. This vulnerability can lead to privacy violations and unauthorized access to personal data of users who upload images.