Cyber Resilience

CVE-2020-36084

CriticalPublic PoC

Published: 05 February 2025

Published
05 February 2025
Modified
02 May 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0059 69.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-36084 is a critical-severity SQL Injection (CWE-89) vulnerability in Jkev Responsive E-Learning System. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-9 (Information Input Restrictions).

Deeper analysis

CVE-2020-36084 is a SQL injection vulnerability (CWE-89) in SourceCodester Responsive E-Learning System 1.0. The flaw resides in the /elearning/delete_teacher_students.php endpoint, where the 'id' parameter fails to properly sanitize user input, allowing remote attackers to inject arbitrary SQL queries.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, no user interaction, and unchanged impact scope. Remote unauthenticated attackers can execute malicious SQL queries to achieve high impacts on confidentiality, integrity, and availability, such as extracting sensitive data, modifying records, or disrupting database operations.

A proof-of-concept exploit is publicly available on Exploit-DB at https://www.exploit-db.com/exploits/49357. No vendor advisories or patch details are referenced in the available information.

EU & UK References

Vulnerability details

SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/delete_teacher_students.php?id= parameter via id field.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct remote unauthenticated exploitation of a public-facing web application via SQL injection on a web endpoint.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-22850Shared CWE-89
CVE-2024-12404Shared CWE-89
CVE-2024-13474Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89

Affected Assets

jkev
responsive e-learning system
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of user inputs like the 'id' parameter in delete_teacher_students.php to block SQL injection exploits.

prevent

Enforces restrictions on information inputs such as limiting the 'id' parameter to valid formats, preventing malicious SQL payloads.

preventdetect

Boundary protection with web application firewalls monitors and filters traffic to the vulnerable endpoint, blocking SQL injection attempts.

References