SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the user's geolocation and device information.
**Describe the bug**
When a user uploads an image in "SLiMS 9 Bulian official source code", the uploaded image’s EXIF Geolocation Data does not gets stripped. As a result, anyone can get sensitive information of "SLiMS 9 Bulian official source code" users like their Geolocation, their Device information like Device Name, Version, Software & Software version used etc.

**CMS Version:**
v9.5.2

**Affected URL:**
http://127.0.0.1/bulian/admin/index.php?mod=membership

**To Reproduce**
Steps to reproduce the behavior:
1) Got to Github ( https://github.com/ianare/exif-samples/tree/master/jpg)
2) There are lot of images having resolutions (i.e 1280 * 720 ) , and also whith different MB’s .
login your admin panel and membership menu and upload photo in any member profile.
3) see the path of uploaded image ( Either by right click on image then copy image address OR right click, inspect the image, the URL will come in the inspect , edit it as html )
4) open it (https://www.verexif.com/en/index.php)
5) See whether is that still showing exif data , if it is then Report it.

**Proof Of Concept:**
You can see the Proof of Concept. which I've attached screenshots and video to confirm the vulnerability.

**Screenshots**
![screenshot1](https://user-images.githubusercontent.com/41516016/229643111-faa0574b-9aa0-4b03-a0d0-da0f7f18e3a1.png)
![screenshot2](https://user-images.githubusercontent.com/41516016/229643122-6698a566-4d72-4b66-b5c5-ede2aedf76d4.png)
![screenshot_2](https://user-images.githubusercontent.com/41516016/229643136-7eefeefc-0bb8-4797-9a2a-5a707157152b.png)
![screenshot3](https://user-images.githubusercontent.com/41516016/229643152-df7cbe53-8070-4735-ba9e-3707f6b3f5a2.png)

**Video**

https://user-images.githubusercontent.com/41516016/229643735-dd78ced5-558d-4817-a6a9-9d34099223d0.mp4




**Desktop (please complete the following information):**
 - OS: Windows 10
 - Browser: Google Chrome
 - 

**Impact**
This vulnerability is CRITICAL and impacts all the "SLiMS 9 Bulian official source code" customer base. This vulnerability violates the privacy of a User and shares sensitive information of the user who uploads an image on SLiMS 9 Bulian official.

Let me know if any further info is required.

Thanks & Regards
**Rahad Chowdhury**
Cyber Security Specialist
https://www.linkedin.com/in/rahadchowdhury

EXIF Geolocation Data Not Stripped From Uploaded Images
This is a GitHub Issue
repo:slims9_bulian
owner:slims
Title : EXIF Geolocation Data Not Stripped From Uploaded Images
Issue date:

--- start body ---
**Describe the bug**
When a user uploads an image in "SLiMS 9 Bulian official source code", the uploaded image’s EXIF Geolocation Data does not gets stripped. As a result, anyone can get sensitive information of "SLiMS 9 Bulian official source code" users like their Geolocation, their Device information like Device Name, Version, Software & Software version used etc.

**CMS Version:**
v9.5.2

**Affected URL:**
http://127.0.0.1/bulian/admin/index.php?mod=membership

**To Reproduce**
Steps to reproduce the behavior:
1) Got to Github ( https://github.com/ianare/exif-samples/tree/master/jpg)
2) There are lot of images having resolutions (i.e 1280 * 720 ) , and also whith different MB’s .
login your admin panel and membership menu and upload photo in any member profile.
3) see the path of uploaded image ( Either by right click on image then copy image address OR right click, inspect the image, the URL will come in the inspect , edit it as html )
4) open it (https://www.verexif.com/en/index.php)
5) See whether is that still showing exif data , if it is then Report it.

**Proof Of Concept:**
You can see the Proof of Concept. which I've attached screenshots and video to confirm the vulnerability.

**Screenshots**
![screenshot1](https://user-images.githubusercontent.com/41516016/229643111-faa0574b-9aa0-4b03-a0d0-da0f7f18e3a1.png)
![screenshot2](https://user-images.githubusercontent.com/41516016/229643122-6698a566-4d72-4b66-b5c5-ede2aedf76d4.png)
![screenshot_2](https://user-images.githubusercontent.com/41516016/229643136-7eefeefc-0bb8-4797-9a2a-5a707157152b.png)
![screenshot3](https://user-images.githubusercontent.com/41516016/229643152-df7cbe53-8070-4735-ba9e-3707f6b3f5a2.png)

**Video**

https://user-images.githubusercontent.com/41516016/229643735-dd78ced5-558d-4817-a6a9-9d34099223d0.mp4




**Desktop (please complete the following information):**
 - OS: Windows 10
 - Browser: Google Chrome
 - 

**Impact**
This vulnerability is CRITICAL and impacts all the "SLiMS 9 Bulian official source code" customer base. This vulnerability violates the privacy of a User and shares sensitive information of the user who uploads an image on SLiMS 9 Bulian official.

Let me know if any further info is required.

Thanks & Regards
**Rahad Chowdhury**
Cyber Security Specialist
https://www.linkedin.com/in/rahadchowdhury

--- end body ---
