{"id":"CVE-2020-37105","state":"PUBLISHED","title":"PMB 5.6 - 'logid' SQL Injection","description":"PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the /admin/sauvegarde/download.php endpoint with manipulated logid values to interact with the database.","publishedAt":"2026-02-03T16:52:43.083Z","updatedAt":"2026-03-05T01:28:01.173Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["redmine PMB"],"affected":[{"vendor":"redmine","product":"PMB","versions":[{"version":"5.6","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/48356","http://www.sigb.net","http://forge.sigb.net/redmine/projects/pmb/files","https://www.vulncheck.com/advisories/pmb-logid-sql-injection"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:47:27.394Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/37xxx/CVE-2020-37105.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2020-37105","state":"PUBLISHED","datePublished":"2026-02-03T16:52:43.083Z","dateUpdated":"2026-03-05T01:28:01.173Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-02-01T13:16:06.490Z"},"containers":{"cna":{"title":"PMB 5.6 - 'logid' SQL Injection","descriptions":[{"lang":"en","value":"PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands through the 'logid' parameter. Attackers can leverage this vulnerability by sending crafted requests to the /admin/sauvegarde/download.php endpoint with manipulated logid values to interact with the database."}],"affected":[{"vendor":"redmine","product":"PMB","versions":[{"version":"5.6","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/48356","name":"ExploitDB-48356","tags":["exploit"]},{"url":"http://www.sigb.net","name":"Vendor Homepage","tags":["product"]},{"url":"http://forge.sigb.net/redmine/projects/pmb/files","name":"Software Download Repository","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/pmb-logid-sql-injection","name":"VulnCheck Advisory: PMB 5.6 - 'logid' SQL Injection","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":7.1,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","lang":"en","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-05T01:28:01.173Z"},"datePublic":"2020-04-20T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sigb:pmb:5.6:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"41-trk (Tarik Bakir)","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-06T20:11:58.546226Z","id":"CVE-2020-37105","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-06T20:12:06.843Z"}}]}}}