CVE-2024-27685 Details
Description
SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload to the $cshortname, $cfullname, and $cdate variables.
A SQL injection vulnerability has been identified in the Student Record System using PHP and MySQL, version 3.20. The issue arises in the add-course.php file, where user-supplied variables are directly inserted into an SQL query without proper sanitization. This flaw allows remote attackers to inject malicious SQL payloads, potentially leading to unauthorized access or manipulation of sensitive database information.
The vulnerability can be remediated by using parameterized queries. Instead of directly concatenating user input into SQL statements, the application should use prepared statements to bind parameters. This approach ensures that user input is treated as data rather than executable code, effectively preventing SQL injection attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| phpgurukul student record system | 3.20 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2025 | Initial Analysis | [email protected] |
| Jun 25, 2025 | CVE Modified | CISA-ADP |
| Jun 25, 2025 | New CVE Received | [email protected] |