CVE Intelligence
Analysis AI-assisted

CVE-2020-37137: PHP-Fusion 9.03.50 Remote Code Execution via Code Injection in panels.php

CVE-2020-37137 is a critical remote code execution flaw in PHP-Fusion 9.03.50, where unsanitized POST data reaches an eval() call in the add_panel_form() function. The NVD assigns CVSS 3.1 base score 9.8, and the record classifies the weakness as CWE-94 (Code Injection). The record shows no fixed version and no KEV listing, so patch status and exploitation status require checking vendor and CNA sources.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2020-37137 describes a remote code execution issue in PHP-Fusion 9.03.50. According to the record, the add_panel_form() function passes unsanitized POST data to eval(), and the weakness is classified as CWE-94 (Code Injection). The CNA is VulnCheck, and the NVD entry status is Analyzed.

Impact

  • The NVD base score is CVSS 3.1 9.8 (Critical), with a vector indicating network reachability, low complexity, no privileges required, no user interaction, and high confidentiality, integrity and availability impact.
  • The record also lists a VulnCheck score of CVSS 4.0 8.6 and a VulnCheck CVSS 3.1 score of 6.1.
  • Code executed through this path would run with the privileges of the web application context. The record does not confirm which privileges apply.

Affected products and versions

  • The record lists the product as Php-fusion Phpfusion, version 9.03.50.
  • No other versions are listed. Whether earlier or later versions are affected is unknown from the record.

Exploitation status

  • The record shows no CISA KEV listing, so no active exploitation is recorded for this CVE.
  • The record references an Exploit-DB entry, which indicates that public exploit material exists. No confirmed exploitation in the wild appears in the sources consulted.
  • No EPSS data is present in the record.

Remediation and mitigation

  • The record contains no fixed version. Treat this as unknown rather than as proof that no fix exists, and check the PHP-Fusion website for official updates.
  • If an immediate upgrade is not possible, restrict access to administrative panels to trusted networks and accounts, and review who can reach panel management functions.
  • Inventory all PHP-Fusion instances and confirm whether any run version 9.03.50.

Detection guidance

  • Review web server logs for unexpected POST requests to the panel administration endpoint panels.php, especially requests with unusual content in panel-related fields.
  • Alert on new or modified files in the web root and on unexpected outbound connections from the web server.
  • Audit administrator accounts for activity that cannot be attributed to known users.

Limitations of the available information

  • The record provides no fixed version, no vendor text confirming a fix, and no EPSS score.
  • The VulnCheck advisory link is marked as broken in the record.
  • The record does not state how exploitable the issue is under specific default or hardened configurations.

Frequently asked questions

Is CVE-2020-37137 known to be actively exploited?

The record shows no CISA KEV listing, so no active exploitation is recorded in the sources consulted. The record does reference a public Exploit-DB entry, which indicates public exploit material exists.

Which versions are affected?

The record lists PHP-Fusion version 9.03.50. Other versions are not listed, so their status is unknown from the record.

Is there a fixed version?

The record does not list a fixed version. The absence does not prove that no fix exists, so check the vendor website for official updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.