Read the docs
TI-2024-03514 Aliases CVE-2024-3768GHSA-fpx7-mqrg-xrvx

PHPGurukul/itsourcecode News Portal search.php sql injection

Priority MEDIUM 59CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
Low · Low · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

A vulnerability, which was classified as critical, has been found in PHPGurukul/itsourcecode News Portal 4.1. This issue affects some unknown processing of the file search.php. The manipulation of the argument searchtitle leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-260615.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00808 57th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHPGurukulNews Portal4.1—No fix listedCNA
itsourcecodeNews Portal4.1—No fix listedCNA
  • News Portal VendorPHPGurukul Affected 4.1 Fixed in — No fix listed CNA
  • News Portal Vendoritsourcecode Affected 4.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:phpgurukul:news_portal_project:4.1:*:*:*:*:*:*:*4.1VulnerablePHPGurukul
  • cpe:2.3:a:phpgurukul:news_portal_project:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·PHPGurukul

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3768
  2. 2026-10-03 Alias added: GHSA-fpx7-mqrg-xrvx

References

Exploit 2

  • TI-2025-04822 PHPGurukul News Portal forgot-password.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-04715 PHPGurukul News Portal Project edit-subcategory.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-04714 PHPGurukul News Portal Project edit-category.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-04713 PHPGurukul News Portal Project add-category.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2025-04716 PHPGurukul News Portal Project edit-subadmin.php sql injection CVSS 4.0MEDIUM 6.9
  • TI-2024-03513 PHPGurukul News Portal edit-post.php sql injection CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences