PHPGurukul Land Record System add-propertytype.php क्रॉस साइट स्क्रिप्टिंग

The XSS vulnerability in Land Record System allows an attacker to inject arbitrary JavaScript code into the application's web pages. This can be exploited by crafting a malicious URL or injecting code through user input fields, specifically the 'Land Property Type' parameter in the /admin/add-propertytype.php file. Successful exploitation could allow an attacker to steal user session cookies, redirect users to phishing sites, or modify the content of the web page displayed to other users. The impact is amplified if the application is used to manage sensitive land records, as an attacker could potentially alter or view confidential information.

Organizations using PHPGurukul Land Record System version 1.0, particularly those handling sensitive land records, are at risk. Shared hosting environments where multiple users share the same server instance are also at increased risk, as a compromise of one user's account could potentially lead to the compromise of other users' accounts.

• php: Examine the /admin/add-propertytype.php file for unsanitized user input handling. Search for instances where the 'Land Property Type' parameter is directly outputted to the page without proper encoding. • generic web: Monitor access logs for suspicious requests to /admin/add-propertytype.php with unusual parameters in the 'Land Property Type' field. • generic web: Use curl to test the endpoint with various payloads: curl 'http://your-land-record-system/admin/add-propertytype.php?Land Property Type=<script>alert("XSS")</script>' • generic web: Check response headers for the presence of X-XSS-Protection or Content-Security-Policy headers, which can mitigate XSS attacks.

1. 2024-12-31Disclosure

   disclosure

1. आरक्षित2024-12-31
2. प्रकाशित2024-12-31
3. संशोधित2025-01-02
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-13075 is to upgrade to version 1.0.1 of PHPGurukul Land Record System. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the 'Land Property Type' field in /admin/add-propertytype.php to sanitize user input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update the application's codebase to address potential security vulnerabilities.