CVE-2020-37154
eLection 2.0 - 'id' SQL Injection
- State
- Published
- Severity
- 7.1 High
- Published
- Feb 6, 2026
- Updated
- Feb 17, 2026
- Reserved
- Feb 3, 2026
Description
eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can leverage SQLMap to exploit the vulnerability, potentially gaining remote code execution by uploading backdoor files to the web application directory.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
eLectionTripath Project |
|
References
- ExploitDB-48122exploit
- eLection Project Vendor Homepageproduct
- Researcher Exploit Disclosuretechnical-descriptionexploit
- VulnCheck Advisory: eLection 2.0 - 'id' SQL Injectionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.