CVE-2020-36972

SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database information. Attackers can systematically test and retrieve database contents by injecting crafted SQL queries that compare character-by-character of database information.

Score

CVSS 4.0 8.8 High

Status

Analyzed - disclosure@vulncheck.com

Published

2026-01-28

Last modified

2026-03-05

Weaknesses

CWE-89

Affected products

• Smartblog (Smartdatasoft)

References

• https://github.com/smartdatasoft/smartblog
• https://www.exploit-db.com/exploits/48995
• https://www.vulncheck.com/advisories/smartblog-idpost-blind-sql-injection