CVE-2024-57687
Published: 10 January 2025
Summary
CVE-2024-57687 is a critical-severity OS Command Injection (CWE-78) vulnerability in Phpgurukul Land Record System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-57687 is an OS Command Injection vulnerability (CWE-78) affecting PHPGurukul Land Record System version 1.0, specifically in the /landrecordsys/admin/dashboard.php component. Published on 2025-01-10, it enables remote attackers to execute arbitrary code by injecting malicious payloads via the "Cookie" GET request parameter. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its severe potential impact.
The vulnerability can be exploited by unauthenticated remote attackers over the network with low attack complexity and no user interaction required. Exploitation allows attackers to run arbitrary operating system commands on the affected server, potentially resulting in high-impact compromise of confidentiality, integrity, and availability, such as data theft, modification, or denial of service.
A detailed technical writeup is available at https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/Land%20record/Command%20Injection.pdf, which may offer additional insights into exploitation techniques. No vendor advisories or patches are referenced in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53712
Vulnerability details
An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the "Cookie" GET request parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS Command Injection vulnerability in public-facing web application (/landrecordsys/admin/dashboard.php) allows remote arbitrary code execution via GET parameter, directly enabling T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the OS command injection flaw in /landrecordsys/admin/dashboard.php by identifying, correcting, and testing fixes for this specific CVE.
Prevents execution of arbitrary OS commands by implementing input validation mechanisms on the 'Cookie' GET parameter to reject malicious payloads.
Mitigates command injection by prohibiting or restricting unnecessary OS command execution functions in the application environment.