← Back to CVEs
CVE-2020-37108
HIGH7.1
Description
PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to manipulate database queries. Attackers can inject malicious SQL code through the 'id' parameter to potentially extract or modify database information.
CVE Details
CVSS v3.1 Score7.1
SeverityHIGH
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
Published2/3/2026
Last Modified2/4/2026
Sourcenvd
Honeypot Sightings0
Weaknesses (CWE)
CWE-89
References
http://www.allhandsmarketing.com/(disclosure@vulncheck.com)
http://www.pcollectionnecktie.com/sandbox/(disclosure@vulncheck.com)
https://www.exploit-db.com/exploits/48138(disclosure@vulncheck.com)
https://www.vulncheck.com/advisories/phpix-professional-id-sql-injection(disclosure@vulncheck.com)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.