CVE-2020-37081
Fishing Reservation System 7.5 - 'uid' SQL Injection
- State
- Published
- Severity
- 7.1 High
- Published
- Feb 3, 2026
- Updated
- Feb 4, 2026
- Reserved
- Feb 1, 2026
Description
Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject malicious SQL commands. Attackers can exploit vulnerable parameters like uid, pid, type, m, y, and code to compromise the database management system and web application without user interaction.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Fishing Reservation SystemFishing Reservation System |
|
References
- ExploitDB-48417exploit
- Vulnerability-Lab Researcher Disclosuretechnical-descriptionexploit
- Fishing Reservation System Homepageproduct
- VulnCheck Advisory: Fishing Reservation System 7.5 - 'uid' SQL Injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.