CVE-2020-37008
SQL Injection Authentication Bypass in EasyPMS 1.0.0 Allows Admin Access
Publication date: 2026-01-29
Last updated on: 2026-01-29
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | easypms | 1.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2020-37008 is an authentication bypass vulnerability in EasyPMS 1.0.0 that allows unprivileged users to manipulate SQL queries embedded in JSON requests. Attackers inject single quotes into ID parameters to bypass authentication and retrieve admin user information. They can then change admin passwords without proper token validation, effectively escalating their privileges to admin. [1, 3]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with no privileges to gain full administrative access by bypassing authentication and modifying admin passwords. This leads to unauthorized access to sensitive data and control over the EasyPMS system, potentially compromising confidentiality and integrity of the system. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusual POST requests to the /Select/STDUSER endpoint containing JSON bodies with manipulated 'Where' clauses that include single quote injections in the ID parameter. For example, detecting JSON POST requests with payloads similar to: { "Action":"Select", "Object":"STDUSER", "Where":[{"Column":"ID'","Operator":"=","Value":"<value>"}, ...] }. Network or application logs can be searched for such patterns. Additionally, attempts to update the STDUSER table without proper authentication tokens can indicate exploitation attempts. Specific commands depend on your environment, but for example, using grep or similar tools on web server logs to find POST requests to /Select/STDUSER with suspicious JSON payloads can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the vendor's patch or update that fixes the authentication bypass vulnerability. If a patch is not yet available, restrict access to the vulnerable endpoints such as /Select/STDUSER to trusted users only, implement proper input validation to prevent SQL injection in JSON requests, and enforce strict authentication and authorization checks on sensitive operations like password changes. Monitoring and blocking suspicious requests that contain single quote injections in ID parameters can also help mitigate exploitation attempts. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized access to administrative user information and modification of admin passwords due to authentication bypass and weak input validation. This unauthorized access and potential data manipulation could lead to violations of data protection standards and regulations such as GDPR and HIPAA, which require strict controls on access to sensitive information and user authentication. However, specific impacts on compliance are not detailed in the provided resources. [1, 3]