PT-2026-6822 · Election · Election

J3Rrybl4Nks · Publicado 2026-02-06 · Atualizado 2026-02-07 · CVE-2020-37154

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions eLection version 2.0

Description The software contains an authenticated SQL injection issue in the candidate management endpoint. Attackers can manipulate database queries through the id parameter. Exploitation can be performed using SQLMap, potentially leading to remote code execution by uploading backdoor files to the web application directory. The API endpoint affected is the candidate management endpoint.

Recommendations Apply input validation and parameterized queries to the id parameter in the candidate management endpoint.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2020-37154

Produtos afetados

Election

Referências · 6

• 🔥 https://exploit-db.com/exploits/48122 · Exploit
• 🔥 https://github.com/J3rryBl4nks/eLection-TriPath-/blob/master/SQLiIntoRCE.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37154 · Nota de Segurança
• https://vulncheck.com/advisories/election-id-sql-injection · Nota
• https://sourceforge.net/projects/election-by-tripath · Nota
• https://t.me/CVEtracker/43985 · Publicação no Telegram