PT-2020-16186 · Projectworlds · Projectworlds Visitor Management System

Ava Tester One + 1 · Published 2020-09-29 · Updated 2026-01-23 · CVE-2020-25760

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Projectworlds Visitor Management System version 1.0

Description The issue allows for SQL Injection due to a lack of input validation on the rid parameter in the front.php file. This enables an attacker to append SQL queries to the input, potentially extracting sensitive information from the database.

Recommendations For version 1.0, ensure input validation is performed on the rid parameter in the front.php file to prevent SQL Injection attacks. As a temporary workaround, consider restricting access to the front.php file until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-25760

Affected Products

Projectworlds Visitor Management System

References · 9

• 🔥 https://packetstormsecurity.com/files/author/15149 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Sep/43 · Exploit
• 🔥 http://packetstormsecurity.com/files/159637/Visitor-Management-System-In-PHP-1.0-SQL-Injection.html · Exploit
• 🔥 http://packetstormsecurity.com/files/159262/Visitor-Management-System-In-PHP-1.0-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25760 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25760 · Vendor Advisory
• https://t.me/cveNotify/149746 · Telegram Post
• https://exploit-db.com/exploits/48911 · Note
• https://t.me/cveNotify/142431 · Telegram Post