PT-2025-6072 · Unknown · Phpgurukul Small Crm

Published 2025-02-10 · Updated 2025-02-13 · CVE-2024-48170

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPGurukul Small CRM version 3.0

Description The issue is related to Cross Site Scripting (XSS) via a crafted payload injected into the name in the profile.php. This allows for potential malicious script execution.

Recommendations For PHPGurukul Small CRM version 3.0, consider disabling the profile.php functionality until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the profile.php page to minimize the risk of exploitation. Avoid using the name variable in the profile.php page until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-48170

Affected Products

Phpgurukul Small Crm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-48170 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48170 · Vendor Advisory
• https://medium.com/@jose.inaciot/cve-2024-48170-bee6ccb773d4 · Note
• https://twitter.com/cybercronai/status/1889842364639842522 · Twitter Post
• https://twitter.com/CVEnew/status/1889008977092002039 · Twitter Post