CVE-2024-51066
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
An IDOR vulnerability in appointment-detail.php in Beauty Parlour Management System v1.1 allows unauthorized access to other customers' Personally Identifiable Information (PII).
Risk Assessment
An attacker can read sensitive PII of other customers, violating privacy and potentially leading to data leakage.
Recommendation
Implement access control mechanisms in appointment-detail.php and conduct a security audit of the application.
Other vulnerabilities in Beauty Parlour Management System
See all- CVE-2026-37431Critical
Beauty Parlour Management System v1.1 was found to have a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
- CVE-2024-53480Critical
A SQL injection vulnerability was found in Phpgurukul's Beauty Parlour Management System v1.1 in `login.php` via the `emailcont` parameter. An attacker can manipulate this parameter to execute unauthorized database queries.
- CVE-2024-51065Critical
A SQL injection vulnerability was found in Phpgurukul Beauty Parlour Management System v1.1 in admin/index.php via the username parameter. An attacker can send a malicious SQL query, leading to unauthorized database access.
Original NVD description (English source)
An Insecure Direct Object Reference (IDOR) vulnerability in appointment-detail.php in Phpgurukul's Beauty Parlour Management System v1.1 allows unauthorized access to the Personally Identifiable Information (PII) of other customers.