CVE-2024–25202 Discover By Agampreet Singh ( Cyber Security Expert )

A vulnerability was found in PHPgurukul visitor management system 1.0. it has been rated as problemic. Affected by the issue is some unknown functionality of the file search bar that called search-result.php and search-visitor.php . The vulnerability is Cross-Site-Scripting (XSS).

CVE-Proof-Of-Concept

Usage

One more Vulnerablity findings in PHPGURUKUL the name is Sql injection in Authentication Session.

Login

After login the account or bypass authentication through Sql injection then we need to go Search management in the top right side.

Payload

‘“><svg/onload=confirm(/xsss/)>

As You see i will search the code in Search Session.

Xss Cross Site Scripting Popup

According to the Scenario XSS vulnerability is valid in search-visitor or search-bar.php.

Thanking you!