CVE-2020-37116: high-severity vulnerability in Openeclass GUnet OpenEclass
GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote Access
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remotely access phpMyAdmin and, after uploading a shell, view the config.php file to obtain the MySQL password, leading to full database compromise.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Openeclass · GUnet OpenEclassRelated CVEs — Openeclass GUnet OpenEclass
In the same product, most dangerous first.
CVE-2020-37113HIGHGUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension BypassEPSS 0.9%CVE-2020-37114MEDIUMGUnet OpenEclass 1.7.3 E-learning platform - Information DisclosureEPSS 0.4%CVE-2020-37112HIGHGUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL InjectionEPSS 0.3%CVE-2020-37115HIGHGUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password StorageEPSS 0.3%