CVE-2020-37004

HIGH

Ultimate Project Manager CRM PRO 2.0.5 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-37004. PoCs published by nag0mez.

AI-analyzed exploit summary This exploit demonstrates a blind SQL injection vulnerability in Ultimate Project Manager CRM PRO 2.0.5, allowing an attacker to leak credentials by brute-forcing usernames and password hashes.

Description

The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users database table. Attackers can exploit the /frontend/get_article_suggestion/ endpoint by crafting malicious search parameters to progressively guess and retrieve user credentials through boolean-based inference techniques.

Exploits (1)

exploitdb WORKING POC
by nag0mez · pythonwebappsphp
https://www.exploit-db.com/exploits/48912

This exploit demonstrates a blind SQL injection vulnerability in Ultimate Project Manager CRM PRO 2.0.5, allowing an attacker to leak credentials by brute-forcing usernames and password hashes.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: Ultimate Project Manager CRM PRO <= 2.0.5
No auth needed
Prerequisites: Network access to the target application · The vulnerable endpoint must be accessible
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory exploit
https://www.exploit-db.com/exploits/48912
Various Sources product
https://ultimatepro.codexcube.com/

Scores

CVSS v3 8.2
EPSS 0.0022
EPSS Percentile 12.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
codexcube/Ultimate Project Manager CRM PRO <= 2.0.5
Published Jan 29, 2026
Tracked Since Feb 18, 2026