CVE-2024-34987

A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md	Exploit Third Party Advisory
https://www.exploit-db.com/exploits/51989	Exploit Third Party Advisory
https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md	Exploit Third Party Advisory
https://www.exploit-db.com/exploits/51989	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpgurukul:online_fire_reporting_system:1.2:*:*:*:*:*:*:*

History

03 Apr 2025, 00:18

Type	Values Removed	Values Added
CPE		cpe:2.3:a:phpgurukul:online_fire_reporting_system:1.2:::::::*
First Time		Phpgurukul Phpgurukul online Fire Reporting System
References	~~() https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md -~~	() https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md - Exploit, Third Party Advisory
References	~~() https://www.exploit-db.com/exploits/51989 -~~	() https://www.exploit-db.com/exploits/51989 - Exploit, Third Party Advisory

Information

Published : 2024-06-03 20:15

Updated : 2025-04-03 00:18

NVD link : CVE-2024-34987

Mitre link : CVE-2024-34987

CVE.ORG link : CVE-2024-34987

JSON object : View

Products Affected

phpgurukul

online_fire_reporting_system

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-34987", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-06-03T20:15:09.273", "references": [{"url": "https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/51989", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.md", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/51989", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n SQL en el script `ofrs/admin/index.php` de PHPGurukul Online Fire Reporting System 1.2. La vulnerabilidad permite a los atacantes eludir la autenticaci\u00f3n y obtener acceso no autorizado inyectando comandos SQL en el campo de entrada del nombre de usuario durante el proceso de inicio de sesi\u00f3n."}], "lastModified": "2025-04-03T00:18:16.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpgurukul:online_fire_reporting_system:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01586EB7-6A02-47C3-8F88-F082F6078EDF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}