Description
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.
References (1)
Core 1
Core References
Exploit, Mitigation, Third Party Advisory
https://github.com/hackerhijeck/Exploited/blob/main/Small_CRM/SQL-Injection.md
Scores
CVSS v3
9.8
EPSS
0.0007
EPSS Percentile
21.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-89
Status
published
Products (1)
small_crm_project/small_crm
3.0
Published
Dec 29, 2023
Tracked Since
Feb 18, 2026