CVE-2024-51065
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A SQL injection vulnerability was found in Phpgurukul Beauty Parlour Management System v1.1 in admin/index.php via the username parameter. An attacker can send a malicious SQL query, leading to unauthorized database access.
Risk Assessment
The risk includes potential loss of confidentiality of customer and employee data, as well as the ability to modify or delete database records. This could compromise system integrity and organizational reputation.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, use prepared statements (parameterized queries) and validate input data for the username parameter.
Other vulnerabilities in Beauty Parlour Management System
See all- CVE-2026-37431Critical
Beauty Parlour Management System v1.1 was found to have a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
- CVE-2024-53480Critical
A SQL injection vulnerability was found in Phpgurukul's Beauty Parlour Management System v1.1 in `login.php` via the `emailcont` parameter. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2024-51066High
An IDOR vulnerability in appointment-detail.php in Beauty Parlour Management System v1.1 allows unauthorized access to other customers' Personally Identifiable Information (PII).
Original NVD description (English source)
Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter.