CVE-2020-37105

Executive Summary

CVE-2020-37105 is a critical SQL injection vulnerability discovered in PMB (PhpMyBibli) version 5.6, a popular open-source library management system. The flaw resides in the /admin/sauvegarde/download.php endpoint, specifically within the logid parameter. An authenticated attacker can inject arbitrary SQL commands, leading to unauthorized data access, modification, or potential full database compromise. Despite the CVSS score being listed as 0.0 in the NVD (likely due to incomplete scoring), the technical impact is severe, with a CVSS vector of 9.8 (Critical) based on the attack vector and impact. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority unpatched vulnerability for organizations using PMB.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects the PMB PHP application, which is typically deployed as a standalone web application or via package managers like apt or yum on Linux distributions. Organizations should verify their PMB installation source and ensure no malicious packages have been introduced.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authenticated access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Potential denial of service via SQL manipulation.

CVSS Score: 8.8 (High) – Based on the vector above, the NVD score of 0.0 is erroneous.

Threat Level: Critical – Unpatched, authenticated SQL injection with high impact.

Deep Dive & Mechanics

The vulnerability exists in the download.php script within the admin/sauvegarde/ directory. The logid parameter is directly concatenated into an SQL query without proper sanitization or parameterization. An authenticated attacker can manipulate the logid value to break out of the intended SQL context and execute arbitrary commands.

Vulnerable Code Snippet (Conceptual):

// /admin/sauvegarde/download.php
$logid = $_GET['logid'];
$query = "SELECT * FROM logs WHERE id = $logid";
$result = mysqli_query($conn, $query);

Attack Vector:

• The attacker must have valid credentials to access the admin panel.
• The request is sent to /admin/sauvegarde/download.php?logid=1 UNION SELECT ...
• The injected SQL can extract data, modify records, or execute stored procedures.

Impact:

• Full database dump (user credentials, library data, etc.)
• Potential privilege escalation if admin credentials are extracted.
• Data integrity loss via UPDATE/DELETE queries.

Vulnerable vs. Patched Code

Vulnerable Code (PMB 5.6):

$logid = $_GET['logid'];
$query = "SELECT * FROM logs WHERE id = $logid";
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

$logid = intval($_GET['logid']);
$query = "SELECT * FROM logs WHERE id = $logid";
$result = mysqli_query($conn, $query);

Or using prepared statements:

$stmt = $conn->prepare("SELECT * FROM logs WHERE id = ?");
$stmt->bind_param("i", $logid);
$stmt->execute();

Key Difference: The patched version uses intval() or prepared statements to ensure the input is treated as an integer, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid admin credentials (e.g., admin:password).
• Network access to the PMB web interface.

Exploitation Steps:

1. Authenticate to the PMB admin panel.
2. Craft a malicious request to the vulnerable endpoint:

   GET /admin/sauvegarde/download.php?logid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100 HTTP/1.1
   Host: target.com
   Cookie: PHPSESSID=...
   

3. Use SQLmap for automated exploitation:

   sqlmap -u "http://target.com/admin/sauvegarde/download.php?logid=1" --cookie="PHPSESSID=..." --batch --dbs
   

Expected Output: Database names, tables, and data extraction.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL queries in database logs.
• Alert on requests to /admin/sauvegarde/download.php with abnormal logid parameters (e.g., containing SQL keywords like UNION, SELECT, OR).

Defense:

• Apply input validation (e.g., intval()) or prepared statements.
• Restrict access to the admin panel via IP whitelisting or VPN.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin/sauvegarde/download.php with logid containing SQL keywords (e.g., UNION, SELECT, OR 1=1).
  • Unusual database query patterns (e.g., high volume of SELECT * FROM information_schema).

• File IOCs:

  • Modified or new files in /var/www/html/admin/sauvegarde/ (if attacker uploads webshells).
  • Suspicious entries in web server logs (e.g., access.log with SQL injection attempts).

• System IOCs:

  • Unexpected database connections from the web server.
  • New user accounts or elevated privileges in the PMB database.

Detection Engineering

YARA Rule

rule CVE_2020_37105_SQLi_Logid {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2020-37105 in PMB"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37105"
    strings:
        $sqli_pattern = /logid=.*(UNION|SELECT|OR|AND|--|#|%27)/ nocase
        $endpoint = "/admin/sauvegarde/download.php"
    condition:
        $endpoint and $sqli_pattern
}

Sigma Rule

title: CVE-2020-37105 PMB SQL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against PMB download.php endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/sauvegarde/download.php'
        cs-uri-query|contains|all:
            - 'logid='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in logid (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2020-37105 PMB SQL Injection Attempt";
    flow:to_server,established;
    content:"/admin/sauvegarde/download.php"; http_uri;
    content:"logid="; http_uri;
    pcre:"/logid=.*(UNION|SELECT|OR|AND|--|#|%27)/i";
    sid:1000001;
    rev:1;
    reference:cve,2020-37105;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the PMB server from untrusted networks if possible.
2. Apply input validation to the logid parameter (e.g., cast to integer).
3. Upgrade to a patched version if available (check PMB official site).
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Rewrite the vulnerable code to use prepared statements or parameterized queries.
• Conduct a full security audit of the PMB codebase.

Workaround:

• Disable the /admin/sauvegarde/download.php endpoint by removing or renaming the file.
• Restrict access to the admin panel via .htaccess:

  <Files "download.php">
      Require ip 192.168.1.0/24
  </Files>
  

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only.