PT-2024-34489 · Unknown · Phpgurukul User Management System

CVE-2024-50991

·

Published

2024-11-11

·

Updated

2024-11-12

CVSS v3.1

4.8

Medium

VectorAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: PHPGurukul User Management System version 1.0
Description: A Cross Site Scripting (XSS) issue was found in the "/ums-sp/admin/registered-users.php" endpoint, allowing remote attackers to execute arbitrary code via the fname POST request parameter.
Recommendations: For PHPGurukul User Management System version 1.0, consider disabling access to the "/ums-sp/admin/registered-users.php" endpoint until a patch is available, and restrict the use of the fname parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50991

Affected Products

Phpgurukul User Management System