CVE-2020-36003

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/TCSWT/Online-Book-Store/blob/main/Online-Book-Store.mdExploit, Third Party Advisory
https://www.sourcecodester.com/download-code?nid=14383&title=Online+Book+StoreProduct, Third Party Advisory
https://www.sourcecodester.com/php/14383/online-book-store.htmlProduct, Third Party Advisory
https://github.com/TCSWT/Online-Book-Store/blob/main/Online-Book-Store.mdExploit, Third Party Advisory
https://www.sourcecodester.com/download-code?nid=14383&title=Online+Book+StoreProduct, Third Party Advisory
https://www.sourcecodester.com/php/14383/online-book-store.htmlProduct, Third Party Advisory

Timeline

Published: Feb 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-360046.5AppCMS 2.0.101 in /admin/download_frame.php has a SQL injection vulnerability which allows attackers to obtain sensitive database informatio CVE-2020-360056.5AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site.CVE-2020-360066.5AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site.CVE-2020-360076.1AppCMS 2.0.101 in /admin/template/tpl_app.php has a cross site scripting attack vulnerability which allows the attacker to obtain sensitive CVE-2020-360088.1OBottle 2.0 in \c\t.php contains an arbitrary file write vulnerability.CVE-2020-360097.5OBottle 2.0 in \c\g.php contains an arbitrary file download vulnerability.CVE-2020-36016.7A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker t CVE-2020-360114.8A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbi CVE-2020-360124.8Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Custome CVE-2020-36026.7A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticated, local attacker t CVE-2020-360236.5An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf CVE-2020-360245.5An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf