CVE-2024-44639
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php. An attacker can manipulate SQL queries when adding a subject.
Risk Assessment
This could lead to unauthorized database access or data modification, threatening system integrity.
Recommendation
Update the application to the latest version or apply security patches. Also, use parameterized queries and input validation.
Other vulnerabilities in PHPGurukul Student Record System
See all- CVE-2024-44636Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. An attacker can inject malicious SQL queries to gain unauthorized access to the database.
- CVE-2024-44635Medium
PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via the adminname and aemailid parameters in /admin-profile.php. An attacker can inject malicious JavaScript that executes in the user's browser.
- CVE-2024-44632Medium
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. An attacker can manipulate SQL queries during password recovery.
Original NVD description (English source)
PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS