CVE-2020-37004
Blind SQL Injection in Ultimate Project Manager CRM 2.0.5 Exposes Credentials
Publication date: 2026-01-29
Last updated on: 2026-01-29
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| codexcube | ultimate_project_manager_crm_pro | to 2.0.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a blind SQL injection in Ultimate Project Manager CRM PRO version 2.0.5 that allows an attacker with valid credentials to extract usernames and SHA512 password hashes from the tbl_users database table. The attacker exploits the /frontend/get_article_suggestion/ endpoint by sending specially crafted search parameters that use boolean-based inference techniques to guess and retrieve user credentials character-by-character. This process involves sending multiple requests to progressively enumerate sensitive credential information from the database. [1]
How can this vulnerability impact me? :
The vulnerability can lead to leakage of sensitive credential information such as usernames and password hashes, which may allow attackers to gain unauthorized access to user accounts. This unauthorized access can lead to further exploitation of the system, potentially compromising confidential data, disrupting operations, or escalating privileges within the application. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /frontend/get_article_suggestion/ endpoint for blind SQL injection via the 'search' parameter. An attacker or tester can send crafted POST requests with boolean-based payloads to infer usernames and password hashes character-by-character by observing response length differences. A Python3 exploit script is available that automates this detection by fuzzing the database using alphanumeric and hexadecimal characters. The script disables SSL verification and suppresses warnings for clean output. Specific commands involve sending POST requests with payloads that check if the response length exceeds a threshold, indicating a correct guess of a character in the username or password hash. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers to extract usernames and password hashes from the database, leading to potential unauthorized access and leakage of sensitive credential information. Such a breach could compromise user data confidentiality and integrity, which may result in non-compliance with data protection regulations like GDPR and HIPAA that require safeguarding personal and sensitive information. However, specific impacts on compliance are not detailed in the provided resources. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, restrict access to the /frontend/get_article_suggestion/ endpoint to trusted users only, implement strict input validation and sanitization on the search parameters to prevent SQL injection, and monitor for suspicious activity targeting this endpoint. Additionally, consider applying any available patches or updates from the vendor and review user privileges to limit exposure. If possible, disable or restrict the vulnerable functionality until a fix is applied. [1]