CVE-2024-34987

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A SQL Injection vulnerability exists in the `ofrs/admin/index.php` script of PHPGurukul Online Fire Reporting System 1.2. The vulnerability allows attackers to bypass authentication and gain unauthorized access by injecting SQL commands into the username input field during the login process.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
phpgurukul	online_fire_reporting_system	1.2

References

https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.mdExploit, Third Party Advisory
https://www.exploit-db.com/exploits/51989Exploit, Third Party Advisory
https://github.com/MarkLee131/PoCs/blob/main/CVE-2024-34987.mdExploit, Third Party Advisory
https://www.exploit-db.com/exploits/51989Exploit, Third Party Advisory

Timeline

Published: Jun 3, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-349889.8SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Add CVE-2024-349899.8In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFP CVE-2024-34998.8The ElementsKit Elementor addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.0 via CVE-2024-3499010.0In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer ca CVE-2024-349917.5In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (CVE-2024-349928.8SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules f CVE-2024-349936.3In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaSh CVE-2024-349949.8In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFee CVE-2024-349954.3svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserC CVE-2024-349977.5joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_arra CVE-2024-35008.8The ElementsKit Pro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.0 via the Price Men CVE-2024-350098.8idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&f