CVE-2024-3768

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in PHPGurukul/itsourcecode News Portal 4.1. This issue affects some unknown processing of the file search.php. The manipulation of the argument searchtitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260615.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
PHPGurukul	News Portal	4.1
itsourcecode	News Portal	4.1

References

https://github.com/BurakSevben/CVEs/blob/main/News%20Portal/News%20Portal%20-%20SQL%20Injection%20-%204.mdExploit, Third Party Advisory
https://github.com/L1OudFd8cl09/CVE/blob/main/25_07_2024_b.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.260615Permissions Required, VDB Entry
https://vuldb.com/?id.260615Third Party Advisory, VDB Entry
https://vuldb.com/?submit.316291Third Party Advisory, VDB Entry
https://github.com/BurakSevben/CVEs/blob/main/News%20Portal/News%20Portal%20-%20SQL%20Injection%20-%204.mdExploit, Third Party Advisory
https://github.com/L1OudFd8cl09/CVE/blob/main/25_07_2024_b.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.260615Permissions Required, VDB Entry
https://vuldb.com/?id.260615Third Party Advisory, VDB Entry
https://vuldb.com/?submit.316291Third Party Advisory, VDB Entry

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-376806.1Hangzhou Meisoft Information Technology Co., Ltd. FineSoft <=8.0 is affected by Cross Site Scripting (XSS) which allows remote attackers to CVE-2024-376816.5An issue the background management system of Shanxi Internet Chuangxiang Technology Co., Ltd v1.0.1 allows a remote attacker to cause a deni CVE-2024-37699.8A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of th CVE-2024-376999.8An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption.CVE-2024-37709.8A vulnerability has been found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this vulnerability is an unk CVE-2024-37718.8A vulnerability was found in PHPGurukul Student Record System 3.20 and classified as critical. Affected by this issue is some unknown functi CVE-2024-37727.5Regular expression denial of service in Pydanic < 2.4.0, < 1.10.13 allows remote attackers to cause denial of service via a crafted email st CVE-2024-377266.8Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges CVE-2024-377287.5Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attack CVE-2024-37735.9The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting the CVE-2024-377326.1Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.CVE-2024-377349.8An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.