Executive brief
PHPGurukul Company Visitor Management System is a web application used to track and manage visitors within a corporate environment. A security vulnerability in the reporting component allows an attacker to inject malicious scripts into the application. If a logged-in user interacts with a specially crafted link, the attacker could execute code in their browser, potentially leading to unauthorized actions or the theft of session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in PHPGurukul Company Visitor Management System 2.0. The issue is located in the /bwdates-reports-details.php file due to insufficient input validation and output sanitization of the 'fromdate' parameter. A remote attacker with low privileges can exploit this by sending a crafted URL to a victim. When the victim visits the link, the malicious script is reflected back and executed in their browser context. This can be used to steal session cookies or perform actions on behalf of the user. A public exploit (PoC) has been disclosed.
Affected products
- PHPGurukul Company Visitor Management System 2.0
Timeline
- 2026-04-04: disclosed: Public GitHub issue with PoC published
- 2026-04-13: advisory: CVE published and VulDB entry created