CVE-2024-44632
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. An attacker can manipulate SQL queries during password recovery.
Risk Assessment
The vulnerability could enable an attacker to access or modify data, posing a risk to system security.
Recommendation
Update the application to a patched version or apply appropriate safeguards. Implement input validation and parameterized queries.
Other vulnerabilities in PHPGurukul Student Record System
See all- CVE-2024-44639Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php. An attacker can manipulate SQL queries when adding a subject.
- CVE-2024-44636Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. An attacker can inject malicious SQL queries to gain unauthorized access to the database.
- CVE-2024-44635Medium
PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via the adminname and aemailid parameters in /admin-profile.php. An attacker can inject malicious JavaScript that executes in the user's browser.
Original NVD description (English source)
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS