Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-11964: PHPGurukul Complaint Management system 1.0 allows attackers to inject malicious SQL code

CVE-2024-11964 · published 1 year ago

Summary

A critical flaw in the PHPGurukul Complaint Management system version 1.0 lets attackers inject malicious code into the system, potentially allowing them to steal or modify sensitive data. This could happen if someone enters a specially crafted email address. To stay safe, update to the latest version of the software, if available, or consider replacing it with a more secure alternative.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
phpgurukul	complaint_management_system	1.0 `cpe:2.3:a:phpgurukul:complaint_management_system:1.0::::-:::`

Original advisory text

A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management system 1.0. This affects an unknown part of the file /user/index.php. The manipulation of the argument emailid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

References

https://github.com/Aurora0x1/CVE/issues/1 Exploit Third Party Advisory
https://phpgurukul.com/ Product
https://vuldb.com/?ctiid.286347 Permissions Required VDB Entry
https://vuldb.com/?id.286347 Third Party Advisory VDB Entry
https://vuldb.com/?submit.452471 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

CWE-89SQL Injection

Timeline

Published28 Nov 2024

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-11964 · NVD

Track software like this

Free during beta