PT-2024-16258 · Unknown · Phpgurukul Vehicle Record System

Jadu101 · Published 2024-10-27 · Updated 2024-10-29 · CVE-2024-10414

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Vehicle Record System version 1.0

Description A problematic issue was found in the PHPGurukul Vehicle Record System, affecting an unknown part of the file /admin/edit-brand.php. The manipulation of the Brand Name argument leads to cross-site scripting. It is possible to initiate the attack remotely. The issue has been disclosed to the public and may be used. There is a mention of the parameter phone number being affected, but this might be a mistake due to the textbox field label being Brand Name.

Recommendations For PHPGurukul Vehicle Record System version 1.0, consider disabling the editing functionality in the /admin/edit-brand.php file until a patch is available to prevent cross-site scripting attacks. Restrict access to the Brand Name field to minimize the risk of exploitation. Avoid using the Brand Name argument in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-10414

Affected Products

Phpgurukul Vehicle Record System

References · 9

• 🔥 https://github.com/jadu101/CVE/blob/main/phpgurukul_vehicle_record_system_edit_brand_xss.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10414 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10414 · Vendor Advisory
• https://phpgurukul.com · Note
• https://t.me/cvedetector/9053 · Telegram Post
• https://t.me/cvenotify/99636 · Telegram Post
• https://vuldb.com/?submit.431623 · Note
• https://vuldb.com/?ctiid.281955 · Note
• https://vuldb.com/?id.281955 · Note