CVE-2024-10159: fallo de gravedad media en PHPGurukul Boat Booking System
PHPGurukul Boat Booking System My Profile Page profile.php sql injection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.6%
A vulnerability classified as critical was found in PHPGurukul Boat Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/profile.php of the component My Profile Page. The manipulation of the argument sadminusername/fullname/emailid/mobilenumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "mobilenumber" to be affected. But it must be assumed that other parameters are affected as well.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Productos afectados
PHPGurukul · Boat Booking SystemCVEs relacionadas — PHPGurukul Boat Booking System
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-10158MEDIUMPHPGurukul Boat Booking System session_start session fixiationEPSS 0.7%CVE-2024-10157MEDIUMPHPGurukul Boat Booking System Reset Your Password Page password-recovery.php sql injectionEPSS 0.7%CVE-2024-10156MEDIUMPHPGurukul Boat Booking System Sign In Page index.php sql injectionEPSS 0.7%CVE-2024-10153MEDIUMPHPGurukul Boat Booking System Book a Boat Page book-boat.php sql injectionEPSS 0.7%CVE-2024-10154MEDIUMPHPGurukul Boat Booking System Check Booking Status Page status.php sql injectionEPSS 0.6%CVE-2025-8431MEDIUMPHPGurukul Boat Booking System add-boat.php sql injectionEPSS 0.6%