CVE-2020-37057: Online-Exam-System 2015 SQL Injection in Feedback Module via fid Parameter
Online-Exam-System 2015 contains an SQL injection flaw (CWE-89) in its feedback module, reachable through the 'fid' parameter. The record states that an attacker could potentially extract, modify or delete database information. NVD rates it critical (9.8, CVSS 3.1), no fixed version is listed, and the CVE is not in the CISA KEV catalog.
Overview
The record describes an SQL injection weakness (CWE-89) in the feedback module of Online-Exam-System 2015, published under the Sunnygkp10 project. The 'fid' parameter is used in database queries without sufficient neutralization of its input.
Impact
The record states that an attacker could use this flaw to extract, modify or delete database information. NVD scores it 9.8 (critical) under CVSS 3.1, with high confidentiality, integrity and availability impact, no privileges required and no user interaction, according to the vector.
Affected products and versions
- Product named in the record: Sunnygkp10 Online-exam-system-.
- Version listed: 2015.
- No fixed version is listed in the record. This does not prove that no fix exists; it means the sources consulted did not provide one.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The Exploit-DB reference indicates a public exploit entry exists, but that alone does not confirm exploitation in the wild.
Remediation and mitigation
- Inventory any deployment of this application, especially internet-facing exam or feedback pages.
- Because no vendor fix is listed, check whether the project has an updated release or a maintained fork, and consider disabling the feedback module until it is reviewed.
- Apply server-side input validation and parameterized database queries to the affected code path, and limit the database account's privileges.
- Restrict access to the application through authentication or network controls where feasible.
Detection guidance
- Review web server and application logs for unusual values in the feedback module's fid parameter, including unexpected characters or database error messages.
- Monitor database logs for atypical queries originating from the web application's database account.
Limitations of the available information
The record does not include a fixed version, EPSS or SSVC data, or vendor-supplied details on the vulnerable code. The VulnCheck advisory link is marked as broken. NVD provides the 9.8 score; the CNA VulnCheck provides 8.8 under version 4.0 and 8.2 under version 3.1.
Frequently asked questions
What is the core weakness in CVE-2020-37057?
The record classifies it as SQL injection (CWE-89) in the feedback module, where the 'fid' parameter can influence database queries.
Is this CVE known to be actively exploited?
No. It is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted.
Is there a fixed version?
The record does not list a fixed version. That means the sources consulted did not provide one, not that no fix exists.
What should defenders do now?
Inventory deployments, consider disabling the feedback module, apply parameterized queries and input validation if you maintain the code, restrict access, and review logs for unusual fid values.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.