CVE-2024-53480
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A SQL injection vulnerability was found in Phpgurukul's Beauty Parlour Management System v1.1 in `login.php` via the `emailcont` parameter. An attacker can manipulate this parameter to execute unauthorized database queries.
Risk Assessment
The risk includes potential leakage of sensitive customer and staff data, as well as the possibility of modifying or deleting database records. This could compromise the confidentiality and integrity of the system.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, use prepared statements (parameterized queries) and input validation in `login.php`.
Other vulnerabilities in Beauty Parlour Management System
See all- CVE-2026-37431Critical
Beauty Parlour Management System v1.1 was found to have a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
- CVE-2024-51065Critical
A SQL injection vulnerability was found in Phpgurukul Beauty Parlour Management System v1.1 in admin/index.php via the username parameter. An attacker can send a malicious SQL query, leading to unauthorized database access.
- CVE-2024-51066High
An IDOR vulnerability in appointment-detail.php in Beauty Parlour Management System v1.1 allows unauthorized access to other customers' Personally Identifiable Information (PII).
Original NVD description (English source)
Phpgurukul's Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in `login.php` via the `emailcont` parameter.