PT-2025-22804 · Unknown · Phpgurukul Medical Card Generation System

Published 2025-05-23 · Updated 2025-06-02 · CVE-2024-48704

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Phpgurukul Medical Card Generation System version 1.0

Description The issue concerns HTML Injection in the admin/contactus.php file via the pagedes parameter. This allows for potential malicious code injection.

Recommendations For Phpgurukul Medical Card Generation System version 1.0, consider validating and sanitizing the pagedes parameter in the admin/contactus.php file to prevent HTML Injection. As a temporary workaround, restrict access to the admin/contactus.php file until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-48704

Affected Products

Phpgurukul Medical Card Generation System

References · 6

• 🔥 https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/HTML%20Injection%28pagedes%29.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48704 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48704 · Vendor Advisory
• https://t.me/cvenotify/124383 · Telegram Post
• https://twitter.com/CVEnew/status/1926244498117419082 · Twitter Post
• https://t.me/cvetracker/24546 · Telegram Post