Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-44648: PHPGurukul Small CRM 3.0 Exposed to Unwanted Database Access

CVE-2024-44648 · published 11 months ago

Summary

A weakness in PHPGurukul Small CRM 3.0 allows an attacker to manipulate the database by injecting malicious code. This could potentially lead to sensitive data being accessed or modified. Users should update to a secure version of the software to prevent unauthorized access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
phpgurukul	small_crm	3.0 `cpe:2.3:a:phpgurukul:small_crm:3.0:::::::*`

Original advisory text

PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.

References

https://github.com/leexsoyoung/CVEs/blob/main/CVE-2024-44648.md Exploit Third Party Advisory
https://phpgurukul.com/small-crm-php/ Product

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published17 Nov 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-44648 · NVD

Track software like this

Free during beta