CVE-2020-35545: Time-based SQL injection exists in Spotweb 1.4.9 via the query string.

PriorityP265critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

3.80%

88.7th percentile

Time-based SQL injection exists in Spotweb 1.4.9 via the query string.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
spotweb_project	spotweb	—	—
spotweb_project	spotweb	>= 0 < 20130826+dfsg3-4	20130826+dfsg3-4
spotweb_project	spotweb	>= 0 < 20130826+dfsg3-4	20130826+dfsg3-4

Detection & IOCsextracted from sources · hover to see the quote

url/?page=index&search[tree]=cat0_z0_c')+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))c)+AND+('↗

commandSELECT+1+FROM+(SELECT(SLEEP(5)))c↗

→Detect time-based blind SQL injection attempts targeting the `search[tree]` query parameter in Spotweb via SLEEP() payloads in GET requests to `/?page=index`. ↗
→Alert on HTTP GET requests to Spotweb where the `search[tree]` parameter contains SQL metacharacters such as single quotes, parentheses, and SQL keywords (AND, SELECT, SLEEP). ↗
→Monitor for anomalous response-time delays (e.g., ~5 seconds) on Spotweb index pages, which may indicate successful time-based SQL injection via SLEEP(). ↗

·The exploit was tested specifically against Spotweb version 1.4.9 on Ubuntu 18.04; applicability to other versions or OS configurations is not confirmed. ↗
·The proof-of-concept uses a SLEEP(5) payload for time-based detection; attackers may vary the sleep duration to evade fixed-threshold detection rules. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

osv9.8CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.