CVE-2020-13568 HIGH

CVE-2020-13568

Vendor N/A
Product phpGACL
Weakness CWE-89 · SQLi
Published April 13, 2021
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability in admin/edit_group.php, when the POST parameter action is “Submit”, the POST parameter parent_id leads to a SQL injection.

Key dates

02Disclosure timeline

April 13, 2021 CVE published
August 4, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-39677 NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities CVE-2024-2943 Campcodes Online Examination System deleteExamExe.php sql injection CVE-2025-10036 Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection CVE-2025-5367 PHPGurukul Online Shopping Portal Project category.php sql injection CVE-2025-11409 Campcodes Advanced Online Voting Management System index.php sql injection