CVE-2020-37112
Published: 03 February 2026
Summary
CVE-2020-37112 is a high-severity SQL Injection (CWE-89) vulnerability in Gunet Open Eclass Platform. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2020-37112 is a SQL injection vulnerability (CWE-89) in GUnet OpenEclass 1.7.3. It stems from multiple unvalidated parameters that enable manipulation of database queries, with the 'month' parameter in the agenda module and other endpoints being prime exploitation points. Attackers can leverage error-based or time-based injection techniques to extract sensitive database information.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), indicating network accessibility, low attack complexity, and low privileges required for authenticated users. Exploitable by such attackers, it allows high-impact confidentiality breaches through data extraction, minor integrity alterations, and no availability disruption.
Advisories and resources include the official CHANGES.txt file at https://download.openeclass.org/files/docs/1.7/CHANGES.txt for potential patch details, a public exploit at https://www.exploit-db.com/exploits/48163, the OpenEclass site at https://www.openeclass.org/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/gunet-openeclass-e-learning-platform-month-sql-injection.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30983
Vulnerability details
GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated parameters. Attackers can exploit the 'month' parameter in the agenda module and other endpoints to extract sensitive database information using error-based or…
more
time-based injection techniques.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a network-accessible web application (OpenEclass) directly enables exploitation of a public-facing app to extract DB data.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs (e.g., the 'month' parameter) before they are used in database queries, blocking the SQL injection vectors described in CVE-2020-37112.
Requires proper error handling so that database error messages are not returned to users, mitigating the error-based SQL injection technique used to extract information.
Enforces least privilege so that even authenticated users have only the minimum rights needed, limiting the scope of data that can be extracted via the injection flaw.