PT-2024-23706 · Unknown · Phpgurukul Complaint Management System

Published 2024-04-17 · Updated 2025-04-10 · CVE-2024-30985

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpgurukul Client Management System version 1.1

Description The issue allows an attacker to execute arbitrary SQL commands via the todate and fromdate parameters in the "B/W Dates Reports" page. This is a SQL Injection vulnerability, which can be exploited by manipulating these parameters to inject malicious SQL code.

Recommendations For phpgurukul Client Management System version 1.1, consider restricting access to the "B/W Dates Reports" page until a patch is available. As a temporary workaround, avoid using the todate and fromdate parameters in this page to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-30985

Affected Products

Phpgurukul Complaint Management System

References · 7

• 🔥 https://medium.com/%40shanunirwan/cve-2024-30985-sql-injection-vulnerability-in-client-management-system-using-php-mysql-1-1-c21fecbda062 · Exploit
• https://osv.dev/vulnerability/CVE-2024-30985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30985 · Security Note
• https://twitter.com/VulmonFeeds/status/1780702809098420717 · Twitter Post
• https://twitter.com/CVEnew/status/1780731197859201194 · Twitter Post
• https://t.me/cvenotify/118584 · Telegram Post
• https://t.me/cvenotify/77223 · Telegram Post