PT-2024-16075 · Unknown · Phpgurukul Boat Booking System

Jadu101 · Published 2024-10-19 · Updated 2024-10-21 · CVE-2024-10162

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPGurukul Boat Booking System version 1.0

Description A critical issue has been found in the PHPGurukul Boat Booking System, affecting the file /admin/edit-subadmin.php of the component Edit Subdomain Details Page. The manipulation of the arguments sadminusername, fullname, emailid, and mobilenumber leads to SQL injection. The attack can be initiated remotely. It is assumed that multiple parameters are affected, not just mobilenumber as initially mentioned.

Recommendations For PHPGurukul Boat Booking System version 1.0, consider disabling the Edit Subdomain Details Page or restricting access to the /admin/edit-subadmin.php file until a patch is available. As a temporary workaround, avoid using the parameters sadminusername, fullname, emailid, and mobilenumber in the affected page to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-10162

Affected Products

Phpgurukul Boat Booking System

References · 11

• 🔥 https://github.com/jadu101/CVE/blob/main/phpgurukul_boat_booking_system_edit_subadmin_sqli.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-10162 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10162 · Security Note
• https://phpgurukul.com · Note
• https://vuldb.com/?ctiid.280948 · Note
• https://vuldb.com/?id.280948 · Note
• https://t.me/cvenotify/98865 · Telegram Post
• https://t.me/cvedetector/8375 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1847889601483944309 · Twitter Post
• https://vuldb.com/?submit.425449 · Note
• https://twitter.com/CVEnew/status/1847808915838210049 · Twitter Post