CVE-2020-35734

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/161457/Batflat-CMS-1.3.6-Remote-Code-Execution.htmlExploit, Third Party Advisory
https://batflat.org/en/changelogRelease Notes, Vendor Advisory
https://github.com/sruupl/batflat/issues/98Exploit, Third Party Advisory
https://secator.pl/index.php/2021/02/15/batflat-v-1-3-6-authenticated-remote-code-execution-public-disclosure/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/161457/Batflat-CMS-1.3.6-Remote-Code-Execution.htmlExploit, Third Party Advisory
https://batflat.org/en/changelogRelease Notes, Vendor Advisory
https://github.com/sruupl/batflat/issues/98Exploit, Third Party Advisory
https://secator.pl/index.php/2021/02/15/batflat-v-1-3-6-authenticated-remote-code-execution-public-disclosure/Exploit, Third Party Advisory

Timeline

Published: Feb 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-357354.7Vidyo 02-09-/D allows clickjacking via the portal/ URI.CVE-2020-357367.5GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.join is misused.CVE-2020-357377.5In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the CVE-2020-357386.1WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument. NOTE: so CVE-2020-35747.5A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the p CVE-2020-357406.1HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.CVE-2020-357416.1HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript synta CVE-2020-357427.6HGiga MailSherlock contains a vulnerability of SQL Injection. Attackers can inject and launch SQL commands in a URL parameter.CVE-2020-357437.6HGiga MailSherlock contains a SQL injection flaw. Attackers can inject and launch SQL commands in a URL parameter of specific cgi pages.CVE-2020-357458.8PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all d CVE-2020-357485.4Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress a CVE-2020-357497.7Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for