CVE-2020-37081

Vulnerability

Analysis

Fishing Reservation System 7.5 suffers from multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php. Attackers can inject malicious SQL commands through the uid, pid, type, m, y, and code parameters [1][2]. The root cause is insufficient sanitization of user-supplied input before constructing SQL queries, allowing the injection of arbitrary SQL statements [2].

Exploitation

The vulnerabilities are exploitable remotely without requiring authentication or user interaction [1][2][4]. An attacker only needs to send specially crafted HTTP requests to the vulnerable scripts, injecting SQL payloads into the listed parameters. The application is web-based and uses a MySQL database, making it accessible over the network [2].

Impact

Successful exploitation can compromise the entire database management system and web application [1][4]. An attacker could extract, modify, or delete sensitive data, including user credentials and reservation records. The CVSS v3 base score of 7.1 (High) reflects the ease of exploitation and the potential for significant data breach [2].

Mitigation

No official patch has been released as of 2020; the vendor's site still promotes the software for sale [3]. Users should immediately apply input validation and parameterized queries to all affected parameters, or consider migrating to an alternative solution that actively addresses security vulnerabilities [1][2][4].