Platform
php
Component
land-record-system
Fixed in
1.0.1
A cross-site scripting (XSS) vulnerability has been identified in PHPGurukul Land Record System versions 1.0 through 1.0. This vulnerability allows attackers to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The affected component resides within the /admin/aboutus.php file. A patch is available in version 1.0.1.
The XSS vulnerability in PHPGurukul Land Record System allows an attacker to inject arbitrary JavaScript code into the application's web pages. This can be exploited to steal user credentials, redirect users to malicious websites, or deface the application's interface. Successful exploitation requires an attacker to manipulate the 'Page Description' parameter within the /admin/aboutus.php file. The impact is particularly severe if the application is used to manage sensitive land records, as an attacker could potentially gain unauthorized access to this data. The public disclosure of this vulnerability increases the risk of exploitation.
This vulnerability has been publicly disclosed, increasing the likelihood of exploitation. The exploit is relatively straightforward, making it accessible to a wide range of attackers. While the CVSS score is LOW, the potential impact on sensitive data warrants prompt remediation. No KEV listing or confirmed exploitation campaigns are currently known as of the publication date.
Exploit Status
EPSS
0.17% (38% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-13080 is to upgrade to version 1.0.1 of PHPGurukul Land Record System. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the 'Page Description' parameter in /admin/aboutus.php to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review access logs for suspicious activity related to the /admin/aboutus.php endpoint. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the 'Page Description' field and verifying that the script is not executed.
Update to a patched version or fix the Cross-Site Scripting (XSS) vulnerability in the /admin/aboutus.php file. Sanitize the input of the 'Page Description' argument to prevent the injection of malicious code. Refer to the provided references for more details about the vulnerability and potential solutions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-13080 is a cross-site scripting (XSS) vulnerability in PHPGurukul Land Record System versions 1.0–1.0, allowing attackers to inject malicious scripts via the 'Page Description' parameter.
You are affected if you are using PHPGurukul Land Record System version 1.0. Check your version and upgrade immediately.
Upgrade to version 1.0.1. If immediate upgrade is not possible, implement input validation and output encoding on the 'Page Description' parameter.
While no active exploitation campaigns are confirmed, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Refer to the PHPGurukul website or security advisories for the official advisory regarding CVE-2024-13080.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.