PT-2024-16169 · Unknown · Phpgurukul Medical Card Generation System

Published 2024-10-23 · Updated 2025-05-06 · CVE-2024-10297

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHPGurukul Medical Card Generation System version 1.0

Description A critical issue was found in the Managecard Edit Image Page component, specifically in the /admin/changeimage.php file. The manipulation of the editid argument leads to SQL injection. This issue can be exploited remotely.

Recommendations For PHPGurukul Medical Card Generation System version 1.0, consider restricting access to the /admin/changeimage.php file until a fix is available. As a temporary workaround, avoid using the editid argument in the affected page to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-10297

Affected Products

Phpgurukul Medical Card Generation System

References · 6

• https://osv.dev/vulnerability/CVE-2024-10297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10297 · Security Note
• https://phpgurukul.com · Note
• https://vuldb.com/?id.281564 · Note
• https://vuldb.com/?ctiid.281564 · Note
• https://t.me/cvenotify/121058 · Telegram Post