CVE-2020-37112

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters. Attackers can exploit the 'month' parameter in the agenda module and other endpoints to extract sensitive database information using error-based or time-based injection techniques.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Openeclass	GUnet OpenEclass	1.7.3

References

https://download.openeclass.org/files/docs/1.7/CHANGES.txtRelease Notes
https://www.exploit-db.com/exploits/48163Exploit, Third Party Advisory, VDB Entry
https://www.openeclass.org/Product
https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-month-sql-injectionThird Party Advisory

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-371138.8GUnet OpenEclass 1.7.3 allows authenticated users to bypass file extension restrictions when uploading files. By renaming a PHP file to .php CVE-2020-371146.5GUnet OpenEclass 1.7.3 allows unauthenticated and authenticated users to access sensitive information, including system information, applica CVE-2020-371154.9GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords w CVE-2020-371168.8GUnet OpenEclass 1.7.3 includes phpMyAdmin 2.10.0.2 by default, which allows remote logins. Attackers with access to the platform can remote CVE-2020-371178.8jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to downl CVE-2020-371183.5P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions w CVE-2020-371199.8Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code CVE-2020-37127.8Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code CVE-2020-371209.8Rubo DICOM Viewer 2.0 contains a buffer overflow vulnerability in the DICOM server name input field that allows attackers to overwrite Struc CVE-2020-371215.5CODE::BLOCKS 16.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Except CVE-2020-371227.5SpotFTP-FTP Password Recover 2.4.8 contains a denial of service vulnerability that allows attackers to crash the application by generating a CVE-2020-371239.8Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket paramet