Vulnerability Description
ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through the 'id' parameter. Attackers can exploit the vulnerability by injecting malicious SQL code into the 'id' parameter of the admin_delete.php script to potentially extract or modify database information.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://atutor.github.io/
- https://www.exploit-db.com/exploits/48117
- https://www.vulncheck.com/advisories/atutor-id-sql-injection
FAQ
What is CVE-2020-37147?
CVE-2020-37147 is a vulnerability with a CVSS score of 7.1 (HIGH). ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through the 'id' parameter. Attackers can exploit...
How severe is CVE-2020-37147?
CVE-2020-37147 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-37147?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.