CVE-2024-48282
CVSS 3.1 Score 7.6 of 10 (high)
Details
Published Oct 15, 2024
Updated: Oct 16, 2024
CWE ID 89
Summary
CVE-2024-48282 is a newly disclosed SQL Injection vulnerability that affects the /password-recovery.php script in the PHPGurukul User Registration & Login and User Management System version 3.2. An attacker can exploit this vulnerability by sending a crafted POST request to the femail parameter, allowing them to inject and execute arbitrary SQL commands. Successful exploitation could result in unauthorized database access. Users are strongly advised to update their systems to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.