PHPGurukul Land Record System add-property.php cross site scripting

Successful exploitation of CVE-2024-13077 allows an attacker to inject malicious scripts into the Land Record System's web interface. This can lead to various consequences, including session hijacking, defacement of the administrative panel, and redirection of users to malicious websites. The attacker could potentially steal sensitive information, such as user credentials or property data, depending on the level of access granted to the compromised account. Given the administrative context of /admin/add-property.php, the impact could be significant if an administrator's session is compromised.

Organizations utilizing PHPGurukul Land Record System version 1.0 are at risk. Specifically, those with publicly accessible administrative interfaces or those who haven't implemented robust input validation measures are particularly vulnerable. Shared hosting environments where multiple users share the same server instance are also at increased risk.

• php: Examine the /admin/add-property.php file for unsanitized input handling of the 'Land Subtype' parameter. • generic web: Monitor access logs for requests to /admin/add-property.php with unusual or suspicious values in the Land Subtype parameter. Use curl to test the endpoint with various payloads: curl 'http://example.com/admin/add-property.php?Land%20Subtype=<script>alert("XSS")</script>' • generic web: Check response headers for Content-Security-Policy (CSP) directives that could mitigate XSS attacks. curl -I http://example.com/admin/add-property.php

1. 2024-12-31Disclosure

   disclosure

1. Gereserveerd2024-12-31
2. Gepubliceerd2024-12-31
3. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-13077 is to upgrade PHPGurukul Land Record System to version 1.0.1 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Land Subtype field to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS payloads targeting the /admin/add-property.php endpoint can provide an additional layer of protection. Regularly review and update input validation routines to prevent future XSS vulnerabilities.