PT-2026-5855 · Davidvg+1 · 60Cyclecms

Unkn0Wn · Publicado 2026-02-03 · Atualizado 2026-02-18 · CVE-2020-37110

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 60CycleCMS version 2.5.2

Description The software contains an SQL injection issue in the 'news.php' and 'common/lib.php' files. Attackers can manipulate database queries through unvalidated user input. Specifically, the 'title' parameter is vulnerable to malicious SQL code injection, potentially allowing attackers to extract or modify database contents. This issue does not involve cross-site scripting.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user-supplied input to the 'title' parameter before using it in database queries.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2020-37110

Produtos afetados

60Cyclecms

Referências · 6

• 🔥 https://exploit-db.com/exploits/48177 · Exploit
• https://vulncheck.com/advisories/cyclecms-newsphp-sql-injection-vulnerability · Nota
• https://osv.dev/vulnerability/CVE-2020-37110 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2020-37110 · Nota de Segurança
• https://t.me/cveNotify/152400 · Publicação no Telegram
• https://opensourcecms.com/60cyclecms · Nota