CVE-2020-36945

Deeper analysis

CVE-2020-36945 is a SQL injection vulnerability (CWE-89) in the WebDamn User Registration Login System, a PHP/MySQL-based user management component. The flaw resides in the login authentication process, where attackers can manipulate email credentials to bypass verification. Specifically, injecting the payload '<email>' OR '1'='1' into both the username and password fields allows unauthorized access to the user panel. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility and significant confidentiality impact.

Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction or privileges required. By submitting the crafted SQL payload during login attempts, they bypass authentication entirely and gain access to the protected user panel, potentially exposing sensitive user data while enabling limited integrity modifications.

Advisories and references, including Exploit-DB (exploit 49170), Vulncheck, and the WebDamn project pages, document the issue and provide proof-of-concept details but do not specify patches or vendor mitigations in the available information. Security practitioners should review these sources for updates and consider input sanitization or prepared statements as standard SQL injection defenses.