CVE-2020-37035 e-learning Php Script 0.1.0 - 'search' SQL Injection
Attackers can inject SQL code via the search parameter to extract or modify sensitive database information in the e-learning PHP Script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-37035?
CVE-2020-37035 is a high-severity SQL injection vulnerability in amitkolloldey e-learning PHP Script, published on 30 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database queries through unvalidated user input. Attackers can inject malicious SQL code in the 'search' parameter to potentially extract, modify, or access sensitive database information.
Weakness: CWE-89
Which versions are affected by CVE-2020-37035?
How do I fix CVE-2020-37035?
No fix has been published for CVE-2020-37035 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-37035 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-37035 exists.
Sources
Also known as GHSA-qf4m-4qwv-w336.