CVE-2024-10414 MEDIUM

CVE-2024-10414: PHPGurukul Vehicle Record System edit-brand.php cross site scripting

Vendor Phpgurukul
Product Vehicle Record System
Weakness CWE-79 · XSS
Published October 27, 2024
Last update October 28, 2024

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A vulnerability, which was classified as problematic, was found in PHPGurukul Vehicle Record System 1.0. This affects an unknown part of the file /admin/edit-brand.php. The manipulation of the argument Brand Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions the parameter "phone_number" to be affected. But this might be a mistake because the textbox field label is "Brand Name".

Key dates

02Disclosure timeline

October 27, 2024 CVE published
October 28, 2024 Record updated