Platform
php
Component
company-visitor-management-system
Fixed in
1.0.1
A cross-site scripting (XSS) vulnerability has been identified in PHPGurukul Company Visitor Management System versions 1.0 through 1.0. This flaw allows attackers to inject malicious scripts, potentially compromising user sessions and data integrity. The vulnerability resides within the file search-visitor.php and can be exploited remotely. A fix is available in version 1.0.1.
Successful exploitation of CVE-2024-0652 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the application. An attacker could potentially gain access to sensitive information stored within the Company Visitor Management System, such as visitor logs and employee details. The impact is amplified if the system is used to manage access to physical locations, as an attacker could potentially use the vulnerability to gain unauthorized access.
This vulnerability has been publicly disclosed, increasing the risk of exploitation. While the CVSS score is LOW, the ease of exploitation and potential impact warrant immediate attention. No active exploitation campaigns have been publicly reported as of the publication date, but the availability of a public proof-of-concept suggests that exploitation is possible. The vulnerability was added to the VDB with identifier VDB-251378.
Exploit Status
EPSS
0.15% (35% percentile)
CVSS Vector
The primary mitigation for CVE-2024-0652 is to upgrade to version 1.0.1 of the PHPGurukul Company Visitor Management System. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the search-visitor.php file to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update security rules to reflect the latest threat intelligence.
Update to a patched version of the PHPGurukul Company Visitor Management System. Contact the vendor for a corrected version or apply necessary security measures to prevent XSS attacks in the search-visitor.php file.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-0652 is a cross-site scripting (XSS) vulnerability affecting PHPGurukul Company Visitor Management System versions 1.0–1.0, allowing attackers to inject malicious scripts.
You are affected if you are using PHPGurukul Company Visitor Management System version 1.0–1.0. Upgrade to version 1.0.1 to mitigate the risk.
Upgrade to version 1.0.1 of the PHPGurukul Company Visitor Management System. Input validation and output encoding can provide temporary protection.
While no active exploitation campaigns have been publicly reported, the vulnerability has been disclosed and a proof-of-concept exists, indicating potential for exploitation.
Refer to the vendor's advisory or security bulletin for PHPGurukul Company Visitor Management System for details on CVE-2024-0652.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.