CVE-2024-44648
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php. An attacker can exploit this flaw to manipulate SQL queries.
Risk Assessment
This could lead to unauthorized data access or modification, threatening the security of the CRM system.
Recommendation
Update to the latest version or apply patches. Also, use parameterized queries and input validation.
Other vulnerabilities in PHPGurukul Small CRM
See all- CVE-2026-90575Low
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the Login Success Handler component. Manipulation of the argument geopluginURL causes deserialization, and the attack can be initiated remotely.
- CVE-2024-44647Medium
PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2025-50484High
In PHPGurukul Small CRM v3.0, improper session invalidation in /crm/change-password.php allows attackers to perform a session hijacking attack.
Original NVD description (English source)
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS