Vulnerability · Published Jan 27, 2026 · Assigned by VulnCheck
CVE-2020-36951Phpscript-sgh 0.1.0 - Time Based Blind SQL Injection
High 8.2
In plain English
A high-severity SQL injection in phpscript-sgh from geraked. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.4%top 70.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Phpscript-sgh 0.1.0 contains a time-based blind SQL injection vulnerability in the admin interface that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit this vulnerability by crafting malicious payloads that trigger time delays, enabling them to extract sensitive database information through conditional sleep techniques.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| geraked | phpscript-sgh | 0.1.0 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-49192 exploit
- Vendor Homepage product
- VulnCheck Advisory: Phpscript-sgh 0.1.0 - Time Based Blind SQL Injection third-party-advisory