PHPGurukul Small CRM vulnerabilities

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the Login Success Handler component. Manipulation of the argument geopluginURL causes deserialization, and the attack can be initiated remotely.

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php. An attacker can exploit this flaw to manipulate SQL queries.

PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. An attacker can inject a malicious script that executes in the victim's browser.

In PHPGurukul Small CRM v3.0, improper session invalidation in /crm/change-password.php allows attackers to perform a session hijacking attack.