CVE-2024-35511 SQL injection in n/a
An attacker can inject SQL commands via the username parameter in the admin login page to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-35511?
CVE-2024-35511 is a medium-severity SQL injection vulnerability in n/a, published on 28 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php.
Weakness: CWE-89
Which versions are affected by CVE-2024-35511?
It affects 1 product.
Products include Phpgurukul Men Salon Management System.
How do I fix CVE-2024-35511?
No fix has been published for CVE-2024-35511 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-35511 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35511 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2024-30998 SQL injection in n/a
- CVE-2025-4297 PHPGurukul Men Salon Management System change-password.php sql injection
- CVE-2025-3827 PHPGurukul Men Salon Management System forgot-password.php sql injection
- CVE-2025-3828 PHPGurukul Men Salon Management System view-appointment.php sql injection
- CVE-2025-3829 PHPGurukul Men Salon Management System sales-reports-detail.php sql injection