PT-2024-16072 · Unknown · Phpgurukul Boat Booking System

Jadu101 · Published 2024-10-19 · Updated 2024-10-22 · CVE-2024-10159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPGurukul Boat Booking System version 1.0

Description A critical issue was found in the PHPGurukul Boat Booking System. It affects an unknown functionality of the file /admin/profile.php of the component My Profile Page. The manipulation of the arguments sadminusername, fullname, emailid, and mobilenumber leads to SQL injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For PHPGurukul Boat Booking System version 1.0, as a temporary workaround, consider disabling the affected functionality in the /admin/profile.php file until a patch is available. Restrict access to the vulnerable My Profile Page component to minimize the risk of exploitation. Avoid using the parameters sadminusername, fullname, emailid, and mobilenumber in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-10159

Affected Products

Phpgurukul Boat Booking System

References · 11

• 🔥 https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_profile_sqli.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-10159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10159 · Security Note
• https://phpgurukul.com · Note
• https://vuldb.com/?ctiid.280945 · Note
• https://t.me/cvedetector/8373 · Telegram Post
• https://t.me/cvenotify/98862 · Telegram Post
• https://vuldb.com/?id.280945 · Note
• https://vuldb.com/?submit.425434 · Note
• https://twitter.com/VulmonFeeds/status/1847894721554792472 · Twitter Post
• https://twitter.com/CVEnew/status/1847784755862884850 · Twitter Post