PT-2025-18272 · Unknown · Phpgurukul Time Table Generator System

Published 2025-04-30 · Updated 2025-04-30 · CVE-2025-45007

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Timetable Generator System version 1.0

Description A Reflected Cross-Site Scripting (XSS) issue was discovered in the profile.php file. This issue allows remote attackers to execute arbitrary JavaScript code via the adminname parameter in a POST request. The affected API endpoint is related to the profile.php file, but the exact endpoint is not specified.

Recommendations For PHPGurukul Timetable Generator System version 1.0, consider disabling the adminname parameter in the POST request to the profile.php file until a patch is available. Restrict access to the profile.php file to minimize the risk of exploitation. Avoid using the adminname parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-45007

Affected Products

Phpgurukul Time Table Generator System

References · 7

• 🔥 https://github.com/rtnthakur/CVE/blob/main/PHPGurukul/Time-Table-Generator-System/xss-injection.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-45007 · Security Note
• https://osv.dev/vulnerability/CVE-2025-45007 · Vendor Advisory
• https://t.me/cvedetector/24090 · Telegram Post
• https://t.me/cvetracker/22706 · Telegram Post
• https://twitter.com/CVEnew/status/1917574653221986530 · Twitter Post
• https://t.me/cvenotify/120301 · Telegram Post