CVE-2020-37051

Deeper analysis

CVE-2020-37051 is a time-based blind SQL injection vulnerability in the Online-Exam-System 2015 application, specifically affecting the feedback form processed by the 'feed.php' endpoint. This flaw, classified under CWE-89, enables attackers to craft malicious payload requests that leverage time delays to systematically enumerate characters in database password hashes. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to its potential for significant confidentiality impact.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. By sending specially crafted requests to 'feed.php', they can extract sensitive database password hashes through blind inference techniques that measure response time differences, potentially compromising user credentials or further escalating access depending on hash strength and reuse.

Advisories from VulnCheck detail the SQL injection in the Online-Exam-System feedback mechanism, while Exploit-DB provides a public proof-of-concept exploit (ID 48560) demonstrating the time-based enumeration. The original source code is available on GitHub at the referenced repository, but no patches or vendor mitigations are specified in the available information. Security practitioners should review these resources for reproduction and apply input validation, prepared statements, or upgrades to remediate.