PHPGurukul Land Record System search-property.php 跨站脚本漏洞

Successful exploitation of CVE-2024-13082 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious actions, including session hijacking, credential theft, and defacement of the application's administrative interface. An attacker could potentially gain unauthorized access to sensitive land record data or manipulate the system's functionality. The impact is particularly severe for administrative users, as their accounts could be compromised, granting the attacker full control over the Land Record System.

Organizations utilizing PHPGurukul Land Record System version 1.0, particularly those with sensitive land record data, are at risk. Shared hosting environments where multiple users share the same server instance are also at increased risk, as a compromise of one user's account could potentially affect others.

• php: Examine /admin/search-property.php for inadequate input sanitization of the 'Search By' parameter. Search for instances where user input is directly outputted to the browser without proper encoding. • generic web: Monitor access logs for unusual requests to /admin/search-property.php with suspicious parameters in the 'Search By' field. Look for patterns indicative of XSS attempts (e.g., <script>). • generic web: Use curl to test the endpoint with a basic XSS payload: curl 'http://<target>/admin/search-property.php?Search By=<script>alert(1)</script>' and observe the response for JavaScript execution.

1. 2024-12-31Disclosure

   disclosure

1. 已保留2024-12-31
2. 发布日期2024-12-31
3. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-13082 is to upgrade to PHPGurukul Land Record System version 1.0.1 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing input validation and output encoding on the 'Search By' parameter within the /admin/search-property.php file. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Carefully review and sanitize all user-supplied input before rendering it in the application's output. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload through the 'Search By' parameter and verifying that it is properly sanitized.