CVE-2024-57687
Published: 10 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-57687 is an OS Command Injection vulnerability (CWE-78) affecting PHPGurukul Land Record System version 1.0, specifically in the /landrecordsys/admin/dashboard.php component. Published on 2025-01-10, it enables remote attackers to execute arbitrary code by injecting malicious payloads via the "Cookie" GET request parameter. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its severe potential impact.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Exploitation allows attackers to run arbitrary operating system commands on the affected server, potentially resulting in high-impact compromise of confidentiality, integrity, and availability, such as data theft, modification, or denial of service.
A detailed technical writeup is available at https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/Command%20Injection.pdf, which may offer additional insights into exploitation techniques. No vendor advisories or patches are referenced in the provided information.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
OS Command Injection vulnerability in public-facing web application (/landrecordsys/admin/dashboard.php) allows remote arbitrary code execution via GET parameter, directly enabling T1190: Exploit Public-Facing Application.