CVE-2024-3767 is a medium severity vulnerability (CVSS 6.3) in PHPGurukul News Portal. The flaw is in the file /admin/edit-post.php, where the posttitle and category parameter reaches a database query without safe handling, which allows SQL injection. No fixed version is named in the record.
What's affected
- PHPGurukul News Portal version 4.1, as listed in the record's product data.
- No other versions are named in the record, so treat any copy of the product as in scope until the vendor says otherwise.
Severity in the record: Medium, CVSS 6.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms: over the network, low privileges required, no user interaction. Weakness class: CWE-89, SQL injection.
Fixed version: The record names no fixed version. Check the vendor and the VulDB entry for a patch, and if none exists, treat the product as unpatched.
Source conflict: The disclosure text in the record calls this issue critical, while the CVSS base score of 6.3 rates it Medium. This post follows the score, and both views are stated here so you can judge it against your own exposure.
The record says the exploit has been disclosed to the public and may be used. That is a statement from the disclosure, not a CISA Known Exploited Vulnerabilities listing, and the record's KEV flag is false.
How to check if you're exposed
- Inventory where PHPGurukul News Portal is deployed, including test and forgotten servers.
- Search the web root for the affected file:
find /var/www -name '*.php' -path '*edit-post.php*'. - If you cannot confirm the version, treat the installation as exposed until the vendor says otherwise.
What to do now
- Ask the vendor or the project for a patched build, and apply it as soon as one exists.
- Until then, put the application behind authentication and a network allow list so only people who need it can reach the page.
- Run the application's database account with the fewest privileges it needs, so a successful query cannot reach other schemas or write to system tables.
- Review the same code for other places that build queries from request parameters, because these products tend to repeat the pattern across many files.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3767.
Why it matters
SQL injection happens when an application builds a database query by pasting user input into the query text. The database cannot tell where the developer's command ends and the visitor's input begins, so a crafted value can change what the query does. The standard fix is a parameterized query or prepared statement, where the input travels separately from the command and is never interpreted as SQL.
The affected page sits under the admin path, so the exposure depends on whether your admin area is reachable and who can sign in to it. Restricting the admin path is a quick risk reducer while you wait for a code fix.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
What is the quickest safe step?
Confirm whether you run PHPGurukul News Portal, then restrict network access to it while you wait for or apply a vendor fix.
Is CVE-2024-3767 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
