CVE-2020-37110
Published: 03 February 2026
Summary
CVE-2020-37110 is a high-severity SQL Injection (CWE-89) vulnerability in Opensourcecms 60Cyclecms. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37110 is an SQL injection vulnerability affecting 60CycleCMS version 2.5.2, specifically in the news.php and common/lib.php components. The flaw arises from unvalidated user input in query parameters such as 'title', enabling attackers to inject malicious SQL code and manipulate database queries. This issue, classified under CWE-89, has a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to its potential for confidential data exposure with low integrity impact and no availability disruption. It does not involve cross-site scripting.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By crafting malicious inputs for vulnerable parameters, they can execute arbitrary SQL queries, potentially extracting sensitive database contents or modifying data, depending on the underlying database permissions and structure.
Advisories and related resources, including an exploit at https://www.exploit-db.com/exploits/48177, the software page at https://www.opensourcecms.com/60cyclecms, and a vulnerability advisory at https://www.vulncheck.com/advisories/cyclecms-newsphp-sql-injection-vulnerability, provide details on the issue but do not specify patches or mitigations in the available information. Security practitioners should assess exposure in 60CycleCMS 2.5.2 deployments and consider upgrading or implementing input validation and prepared statements.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30985
Vulnerability details
60CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queries through unvalidated user input. Attackers can exploit vulnerable query parameters like 'title' to inject malicious SQL code and potentially extract or modify…
more
database contents. This issue does not involve cross-site scripting.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing web app via SQL injection in query parameters.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection by requiring validation of unvalidated user inputs like the 'title' parameter before incorporation into database queries in news.php and common/lib.php.
Requires timely identification, reporting, testing, and remediation of the specific SQL injection flaw in 60CycleCMS 2.5.2 to eliminate the vulnerability.
Provides vulnerability scanning to identify SQL injection issues like CVE-2020-37110 in web applications such as 60CycleCMS.