Paper/Archive/CVE-2024-34987

CVE-2024-34987

phpgurukul online_fire_reporting_system — A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2.

EPSS 0.6%public exploit CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 49.1.491 × 209.8 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

online_fire_reporting_system1.2–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refgithub.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md refexploit-db.com/exploits/51989