PT-2025-21944 · Unknown · Phpgurukul Medical Card Generation System

Published 2025-05-19 · Updated 2025-05-28 · CVE-2024-51106

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PHPGURUKUL Medical Card Generation System version 1.0

Description: A cross-site scripting (XSS) issue exists in the component mcgs/admin/aboutus.php, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the pagetitle parameter.

Recommendations: For PHPGURUKUL Medical Card Generation System version 1.0, consider restricting access to the pagetitle parameter in the mcgs/admin/aboutus.php component to minimize the risk of exploitation. Avoid using the pagetitle parameter in the affected component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-51106

Affected Products

Phpgurukul Medical Card Generation System

References · 5

• 🔥 https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Stored%20XSS-About%20Us.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2024-51106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51106 · Security Note
• https://twitter.com/CVEnew/status/1924478655524139297 · Twitter Post
• https://t.me/cvenotify/123776 · Telegram Post