CVE-2020-37116
📋 TL;DR
CVE-2020-37116 allows attackers with access to GUnet OpenEclass 1.7.3 to remotely access the default phpMyAdmin installation, upload a web shell, and extract database credentials from config.php, leading to full database compromise. This affects all deployments using the vulnerable OpenEclass version with default configuration.
💻 Affected Systems
- GUnet OpenEclass
- phpMyAdmin
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including sensitive user data, credentials, and potential lateral movement to other systems via database connections.
Likely Case
Database exfiltration, credential theft, and potential website defacement or data manipulation.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized access to the web interface.
🎯 Exploit Status
Exploit requires initial access to OpenEclass platform, then straightforward phpMyAdmin access and file upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenEclass versions after 1.7.3
Vendor Advisory: https://www.openeclass.org/
Restart Required: No
Instructions:
1. Upgrade OpenEclass to latest version. 2. Remove or secure phpMyAdmin installation. 3. Change database credentials after patching.
🔧 Temporary Workarounds
Remove phpMyAdmin
linuxDelete or disable the phpMyAdmin directory from the OpenEclass installation
rm -rf /path/to/openeclass/phpMyAdmin/
Restrict phpMyAdmin Access
allConfigure web server to block access to phpMyAdmin directory
# Add to Apache .htaccess or nginx config: Deny from all
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access the OpenEclass web interface
- Change all database credentials and implement database-level access controls
🔍 How to Verify
Check if Vulnerable:
Check if /phpMyAdmin directory exists in OpenEclass installation and is accessible via web browserCheck Version:
Check OpenEclass version in admin panel or read CHANGES.txt fileVerify Fix Applied:
Verify phpMyAdmin directory is removed or returns 403/404 error when accessed📡 Detection & Monitoring
Log Indicators:
- Access to phpMyAdmin directories
- File uploads to phpMyAdmin
- Unusual database queries from web server IP
Network Indicators:
- HTTP requests to /phpMyAdmin paths
- Uploads of PHP files to web directories
SIEM Query:
web.url:*phpMyAdmin* AND (http.method:POST OR web.url:*upload*)