CVE-2024-44630: PHPGurukul Student Record System · SQL Injection
Source CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 14 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should immediately audit their use of PHPGurukul Student Record System and identify if version 3.20 or earlier is deployed. Since no official patches are currently available, organizations should implement the following mitigations: 1) Apply strict input validation and sanitization on all user-supplied data fields, especially those listed as vulnerable parameters. 2) Refactor the application code to use parameterized queries or prepared statements to prevent SQL injection. 3) Employ Web Application Firewalls (WAFs) with SQL injection detection rules to block malicious payloads targeting these parameters. 4) Conduct thorough security testing, including automated and manual penetration testing focused on injection flaws. 5) Monitor application logs for suspicious input patterns or errors indicative of injection attempts. 6) Limit database user privileges to the minimum necessary to reduce impact if exploitation occurs. 7) Prepare incident response plans for potential data breaches involving student records. Organizations should also stay alert for official patches or updates from PHPGurukul and apply them promptly once released.
Description
Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These include: c-full, fname, mname,lname, gname, ocp, nation, mobno, email, board1, roll1, pyear1, board2, roll2, pyear2, sub1,marks1, sub2, course-short, income, category, ph, country, state, city, padd, cadd, and gender.