CVE-2024-48283

The vulnerability exists in the /admin//search-result.php file, where the searchkey parameter passed by the user is not properly validated or filtered before being used in an SQL query. An attacker can inject malicious SQL code directly into this parameter, manipulating the logic of the query executed by the database server. The attack does not require authentication or user interaction, which significantly lowers the threshold for its execution.

An attacker can gain unauthorized access to the complete database contents (including user and administrator credentials), and depending on the database server configuration — also modify or delete data and potentially execute system commands.

Patches available from the vendor should be applied according to the references. As a temporary measure, it is recommended to restrict access to the administration panel exclusively to trusted IP addresses and implement WAF rules blocking typical SQL Injection patterns.

Phpgurukul User Registration & Login and User Management System version 3.2