CVE-2020-37076

HIGH

Victor CMS 1.0 - SQL Injection via Post Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-37076. PoCs published by BKpatron.

AI-analyzed exploit summary This exploit demonstrates SQL injection in Victor CMS 1.0 via the 'post' parameter in post.php. It includes payloads for boolean-based blind, error-based, time-based blind, and UNION-based SQLi techniques.

Description

Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted UNION SELECT payloads to extract database information through boolean-based, error-based, and time-based injection techniques.

Exploits (1)

exploitdb WORKING POC
by BKpatron · textwebappsphp
https://www.exploit-db.com/exploits/48451

This exploit demonstrates SQL injection in Victor CMS 1.0 via the 'post' parameter in post.php. It includes payloads for boolean-based blind, error-based, time-based blind, and UNION-based SQLi techniques.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: Victor CMS v1.0
No auth needed
Prerequisites: Access to the vulnerable post.php endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory, VDB Entry exploit
https://www.exploit-db.com/exploits/48451
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/victor-cms-post-sql-injection

Scores

CVSS v3 8.2
EPSS 0.0037
EPSS Percentile 28.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
victor_cms_project/victor_cms 1.0
Published Feb 03, 2026
Tracked Since Feb 18, 2026