Home

Description

Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted UNION SELECT payloads to extract database information through boolean-based, error-based, and time-based injection techniques.

PUBLISHED Reserved 2026-02-01 | Published 2026-02-03 | Updated 2026-02-04 | Assigner VulnCheck




HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

1.0
affected

Credits

BKpatron finder

References

www.exploit-db.com/exploits/48451 (ExploitDB-48451) exploit

github.com/VictorAlagwu/CMSsite (Victor CMS GitHub Repository) product

www.vulncheck.com/advisories/victor-cms-post-sql-injection (VulnCheck Advisory: Victor CMS 1.0 - 'post' SQL Injection) third-party-advisory

cve.org (CVE-2020-37076)

nvd.nist.gov (CVE-2020-37076)

Download JSON