CVE-2020-37112: high-severity vulnerability in Openeclass GUnet OpenEclass
GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters. Attackers can exploit the 'month' parameter in the agenda module and other endpoints to extract sensitive database information using error-based or time-based injection techniques.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Openeclass · GUnet OpenEclassRelated CVEs — Openeclass GUnet OpenEclass
In the same product, most dangerous first.
CVE-2020-37113HIGHGUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension BypassEPSS 0.9%CVE-2020-37116HIGHGUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote AccessEPSS 0.5%CVE-2020-37114MEDIUMGUnet OpenEclass 1.7.3 E-learning platform - Information DisclosureEPSS 0.4%CVE-2020-37115HIGHGUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password StorageEPSS 0.3%