PT-2020-16255 · Phpgurukul · Phpgurukul User Registration & Login/User Management System With Admin Panel

Published 2020-11-16 · Updated 2024-12-27 · CVE-2020-25952

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPGurukul User Registration & Login and User Management System With admin panel version 2.1

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication. This is a SQL injection vulnerability.

Recommendations For PHPGurukul User Registration & Login and User Management System With admin panel version 2.1, consider temporarily disabling the user registration and login functionality until a patch is available. Restrict access to the admin panel to minimize the risk of exploitation. Avoid using user input in SQL queries until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-25952

Affected Products

Phpgurukul User Registration & Login/User Management System With Admin Panel

References · 12

• 🔥 https://th3cyb3rc0p.medium.com/cve-2020-25952-f60fff8ffac · Exploit
• 🔥 https://systemweakness.com/cve-2020-25952-f60fff8ffac · Exploit
• https://osv.dev/vulnerability/CVE-2020-25952 · Vendor Advisory
• https://phpgurukul.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25952 · Security Note
• https://t.me/cvenotify/5630 · Telegram Post
• https://t.me/cvenotify/6267 · Telegram Post
• https://t.me/cibsecurity/16364 · Telegram Post
• https://t.me/pentestingnews/841 · Telegram Post
• https://exploit-db.com/exploits/49052 · Note
• https://t.me/cvenotify/105601 · Telegram Post
• https://t.me/cvenotify/13585 · Telegram Post