Platform
php
Component
land-record-system
Fixed in
1.0.1
A cross-site scripting (XSS) vulnerability has been identified in PHPGurukul Land Record System versions 1.0 through 1.0. This flaw allows attackers to inject malicious scripts into the application, potentially compromising user accounts and data. The vulnerability resides in the processing of the /admin/search-property.php file, specifically through manipulation of the 'Search By' argument. A patch is available in version 1.0.1.
Successful exploitation of CVE-2024-13082 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the application's administrative interface. An attacker could potentially gain unauthorized access to sensitive land record data or manipulate the system's functionality. The impact is particularly severe for administrative users, as their accounts could be compromised, granting the attacker full control over the Land Record System.
This vulnerability has been publicly disclosed, increasing the risk of exploitation. While the CVSS score is LOW, the ease of exploitation and potential impact on sensitive data warrant immediate attention. No known active campaigns targeting this specific vulnerability have been reported as of the publication date. The vulnerability is not currently listed on CISA's KEV catalog.
Exploit Status
EPSS
0.17% (38% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-13082 is to upgrade to PHPGurukul Land Record System version 1.0.1 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing input validation and output encoding on the 'Search By' parameter within the /admin/search-property.php file. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Carefully review and sanitize all user-supplied input before rendering it in the application's output. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload through the 'Search By' parameter and verifying that it is properly sanitized.
Update to a patched version or apply the necessary security measures to prevent the injection of malicious code through the 'Search By' parameter in the file /admin/search-property.php. Validate and escape user inputs to prevent XSS attacks. If a patched version is not available, consider disabling or restricting access to the vulnerable functionality until a solution can be applied.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-13082 is a cross-site scripting (XSS) vulnerability affecting PHPGurukul Land Record System versions 1.0–1.0, allowing attackers to inject malicious scripts via the /admin/search-property.php file.
You are affected if you are using PHPGurukul Land Record System version 1.0–1.0. Upgrade to version 1.0.1 to mitigate the risk.
Upgrade to PHPGurukul Land Record System version 1.0.1 or later. As a temporary measure, implement input validation and output encoding on the 'Search By' parameter.
While no active campaigns have been confirmed, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Refer to the PHPGurukul website or security advisories for the official advisory regarding CVE-2024-13082.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.