PT-2021-24187 · Unknown · Phpgurukul Employee Record Management System

Published 2021-12-13 · Updated 2023-09-25 · CVE-2021-44966

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Employee Record Management System version 1.2

Description: The issue allows an attacker to bypass authentication via SQL injection in the index.php file, potentially granting access to an admin account. This could enable the attacker to destroy, change, or manipulate sensitive information on the system.

Recommendations: For PHPGURUKUL Employee Record Management System version 1.2, consider disabling access to the index.php file until a patch is available to prevent SQL injection attacks. Restrict access to sensitive information and admin accounts to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-44966

Affected Products

Phpgurukul Employee Record Management System

References · 4

• 🔥 https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PHPGURUKUL/ANUJ%20KUMAR/Employee-Record-Management-System-SQL-Injection-Bypass-Authentication · Exploit
• https://osv.dev/vulnerability/CVE-2021-44966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44966 · Security Note
• https://t.me/cibsecurity/33846 · Telegram Post