Home

Description

Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject malicious SQL commands. Attackers can exploit vulnerable parameters like uid, pid, type, m, y, and code to compromise the database management system and web application without user interaction.

PUBLISHED Reserved 2026-02-01 | Published 2026-02-03 | Updated 2026-02-04 | Assigner VulnCheck




HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
HIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

7.5
affected

Credits

Vulnerability Laboratory, Benjamin Kunz Mejri finder

References

www.exploit-db.com/exploits/48417 (ExploitDB-48417) exploit

www.vulnerability-lab.com/get_content.php?id=2243 (Vulnerability-Lab Researcher Disclosure) technical-description exploit

fishingreservationsystem.com/index.html (Fishing Reservation System Homepage) product

www.vulncheck.com/...ng-reservation-system-uid-sql-injection (VulnCheck Advisory: Fishing Reservation System 7.5 - 'uid' SQL Injection) third-party-advisory

cve.org (CVE-2020-37081)

nvd.nist.gov (CVE-2020-37081)

Download JSON