What is the CVSS score of CVE-2024-27685?

CVE-2024-27685 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2024-27685?

A SQL injection vulnerability in the Student Record system (v.3.20) exposes sensitive student data to unauthorized access by remote attackers without authentication.

How to fix or mitigate CVE-2024-27685?

Within 24 hours: Isolate the Student Record system from untrusted networks or disable public access; implement WAF rules to block SQL injection patterns on affected parameters ($cshortname, $cfullname, $cdate). Within 7 days: Conduct database audit for unauthorized access logs; notify legal/compliance of potential breach obligations. Within 30 days: Upgrade to patched version when available; if unavailable, implement input validation/parameterized queries via code patch or replace the system.

PHP CVE-2024-27685

EUVD-2024-24879 HIGH

SQL Injection (CWE-89)

2025-06-25 cve@mitre.org

PHP SQLi MySQL Information Disclosure Student Record System

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2024-24879

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 15:15 nvd

HIGH 7.1

DescriptionCVE.org

SQL Injection vulnerability in Student Record system Using PHP and MySQL v.3.20 allows a remote attacker to obtain sensitive information via a crafted payload to the $cshortname, $cfullname, and $cdate variables.

AnalysisAI

A SQL injection vulnerability in Student Record system Using PHP and MySQL v (CVSS 7.1) that allows a remote attacker. High severity vulnerability requiring prompt remediation.