CVE-2024-44636
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. An attacker can inject malicious SQL queries to gain unauthorized access to the database.
Risk Assessment
SQL Injection vulnerability may allow theft, modification, or deletion of database data, as well as bypassing authentication mechanisms and gaining administrative access.
Recommendation
Update the software to a patched version or use parameterized queries and input validation for the adminname and aemailid parameters.
Other vulnerabilities in PHPGurukul Student Record System
See all- CVE-2024-44639Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php. An attacker can manipulate SQL queries when adding a subject.
- CVE-2024-44635Medium
PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via the adminname and aemailid parameters in /admin-profile.php. An attacker can inject malicious JavaScript that executes in the user's browser.
- CVE-2024-44632Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. An attacker can manipulate SQL queries during password recovery.
Original NVD description (English source)
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS