CVE-2020-36541

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Demokratian. It has been rated as critical. Affected by this issue is some unknown functionality of the file basicos_php/genera_select.php. The manipulation of the argument id_provincia with the input -1%20union%20all%20select%201,2,3,4,database() leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
unspecified	Demokratian	n/a

References

https://alquimistadesistemas.com/sql-injection-y-archivo-peligroso-en-demokratianExploit, Patch, Third Party Advisory
https://bitbucket.org/csalgadow/demokratian_votaciones/commits/b56c48b519fc52efa65404c312ea9bbde320e3faPatch, Third Party Advisory
https://vuldb.com/?id.159434Third Party Advisory
https://alquimistadesistemas.com/sql-injection-y-archivo-peligroso-en-demokratianExploit, Patch, Third Party Advisory
https://bitbucket.org/csalgadow/demokratian_votaciones/commits/b56c48b519fc52efa65404c312ea9bbde320e3faPatch, Third Party Advisory
https://vuldb.com/?id.159434Third Party Advisory

Timeline

Published: Jun 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-365429.8A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The man CVE-2020-365438.8A vulnerability, which was classified as critical, was found in SialWeb CMS. This affects an unknown part of the file /about.php. The manipu CVE-2020-365445.4A vulnerability has been found in SialWeb CMS and classified as problematic. This vulnerability affects unknown code of the component Search CVE-2020-365477.8A vulnerability was found in GE Voluson S8. It has been rated as critical. This issue affects the Service Browser which itroduces hard-coded CVE-2020-365487.8A vulnerability classified as problematic has been found in GE Voluson S8. Affected is the file /uscgi-bin/users.cgi of the Service Browser.CVE-2020-365497.8A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches m CVE-2020-365505.4Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Table Name field to /dashbo CVE-2020-365515.4Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Item Name field to /dashboa CVE-2020-365525.4Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Made field to /dashboard/me CVE-2020-365535.4Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Area(food_type) field to /d CVE-2020-365575.1A race condition in the Linux kernel before 5.6.2 between the VT_DISALLOCATE ioctl and closing/opening of ttys could lead to a use-after-fre CVE-2020-365585.1A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault