Vulnerability Description
EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak input validation by injecting single quotes in ID parameters and modify admin user passwords without proper token authentication.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://www.elektraweb.com/en/
- https://www.exploit-db.com/exploits/48858
- https://www.vulncheck.com/advisories/easypms-authentication-bypass
- https://www.exploit-db.com/exploits/48858
FAQ
What is CVE-2020-37008?
CVE-2020-37008 is a vulnerability with a CVSS score of 7.5 (HIGH). EasyPMS 1.0.0 contains an authentication bypass vulnerability that allows unprivileged users to manipulate SQL queries in JSON requests to access admin user information. Attackers can exploit weak inp...
How severe is CVE-2020-37008?
CVE-2020-37008 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-37008?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.