CVE-2020-36084
Published: 05 February 2025
Summary
CVE-2020-36084 is a critical-severity SQL Injection (CWE-89) vulnerability in Jkev Responsive E-Learning System. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).
Deeper analysis
CVE-2020-36084 is a SQL injection vulnerability (CWE-89) in SourceCodester Responsive E-Learning System 1.0. The flaw resides in the /elearning/delete_teacher_students.php endpoint, where the 'id' parameter fails to properly sanitize user input, allowing remote attackers to inject arbitrary SQL queries.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, no user interaction, and unchanged impact scope. Remote unauthenticated attackers can execute malicious SQL queries to achieve high impacts on confidentiality, integrity, and availability, such as extracting sensitive data, modifying records, or disrupting database operations.
A proof-of-concept exploit is publicly available on Exploit-DB at https://www.exploit-db.com/exploits/49357. No vendor advisories or patch details are referenced in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-23662
Vulnerability details
SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/delete_teacher_students.php?id= parameter via id field.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing web application via SQL injection on a web endpoint.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user inputs like the 'id' parameter in delete_teacher_students.php to block SQL injection exploits.
Enforces restrictions on information inputs such as limiting the 'id' parameter to valid formats, preventing malicious SQL payloads.
Boundary protection with web application firewalls monitors and filters traffic to the vulnerable endpoint, blocking SQL injection attempts.