CVE-2020-20300 Scanner

WeiPHP is a popular open-source content management system (CMS) designed for building business websites, e-commerce platforms, and blogs. It offers a user-friendly interface and extensive customization options, making it a preferred choice for developers and organizations seeking to manage online content efficiently. Its modular architecture supports various plugins and themes, enhancing functionality and user experience.

CVE-2020-20300 is a critical SQL injection vulnerability discovered in WeiPHP version 5.0. This flaw arises from insufficient sanitization of user-supplied input within the wp_where function, which is used to construct SQL queries dynamically. Attackers can exploit this by injecting malicious SQL code through parameters passed to this function, bypassing authentication and authorization controls.

The vulnerability specifically affects the wp_where function, which is commonly invoked in database query building processes. By manipulating input parameters such as those in search or filter operations, an attacker can execute arbitrary SQL commands. This allows them to retrieve, modify, or delete data from the underlying MySQL database without proper privileges.

Successful exploitation of CVE-2020-20300 can lead to severe consequences, including unauthorized access to sensitive user data, such as passwords, personal information, and financial records. Attackers may also escalate privileges, compromise the entire application, or use the database as a pivot point for further attacks. The high CVSS score of 9.8 underscores the critical nature of this vulnerability.