CVE-2020-35276: n/a SQLi bypasses admin login

CISO Take

This CVE is a classic SQL injection in EgavilanMedia ECM Address Book 1.0 that lets an unauthenticated attacker bypass the admin login form and obtain full administrative access, including creating or deleting users. It carries an EPSS score of 0.0153 (top 28% most-likely-to-be-exploited), but there is no public exploit code, no Nuclei template, and it is not in the CISA KEV catalog, so active mass-exploitation is unlikely today. Despite being tagged in our feed under the 'ml_ui' AI category, the affected product is a generic PHP contact-management CMS with no documented AI/ML functionality and no match against any tracked AI package — this looks like a classification artifact rather than a genuine AI supply-chain exposure, and should be deprioritized in an AI-risk register accordingly. If this software is deployed anywhere in your environment (e.g., bundled into an internal portal), patch or retire the component and treat any admin panel exposed to the internet as high-risk regardless of the AI tag; no vendor patch is referenced in available sources, so isolation/replacement is the practical mitigation.

Sources: NVD EPSS

What is the risk?

Low relevance to AI/ML risk despite feed tagging. Technically the vulnerability is severe in isolation (unauthenticated SQLi leading to full admin takeover), but there is no CVSS score published, no KEV listing, no public exploit, and no scanner template — reducing near-term exploitation likelihood. More importantly, the affected product (EgavilanMedia ECM Address Book) shows no evidence of AI/ML functionality, so this CVE should not be weighted as an AI supply-chain threat; it is a generic web-application auth-bypass issue that happens to appear in this feed.

How does the attack unfold?

Initial Access

Attacker submits a SQL injection payload via the admin login panel to bypass authentication.

AML.T0049

Privilege Escalation

The bypassed login grants the attacker full administrative session privileges.

Impact

Attacker adds or removes user accounts, establishing persistent unauthorized control over the application.

Initial Access

Attacker submits a SQL injection payload via the admin login panel to bypass authentication.

AML.T0049

Privilege Escalation

The bypassed login grants the attacker full administrative session privileges.

Impact

Attacker adds or removes user accounts, establishing persistent unauthorized control over the application.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

1.5%

chance of exploitation in 30 days

Higher than 73% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Confirm whether EgavilanMedia ECM Address Book 1.0 is deployed anywhere in the environment (it is unlikely to be part of any AI/ML stack). 2) No vendor patch is referenced in available sources — apply input validation/parameterized queries to the admin login flow, or take the application offline/replace it if patching isn't feasible. 3) Restrict network exposure of the admin login panel (VPN/allowlist). 4) Add WAF/IDS signatures for SQLi patterns targeting login parameters. 5) Audit for unexpected admin accounts as a compromise indicator. 6) Reclassify this CVE out of the AI/ML threat feed unless a genuine AI integration is confirmed.

How is it classified?

Auth Bypass Data Leakage Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2020-35276?

This CVE is a classic SQL injection in EgavilanMedia ECM Address Book 1.0 that lets an unauthenticated attacker bypass the admin login form and obtain full administrative access, including creating or deleting users. It carries an EPSS score of 0.0153 (top 28% most-likely-to-be-exploited), but there is no public exploit code, no Nuclei template, and it is not in the CISA KEV catalog, so active mass-exploitation is unlikely today. Despite being tagged in our feed under the 'ml_ui' AI category, the affected product is a generic PHP contact-management CMS with no documented AI/ML functionality and no match against any tracked AI package — this looks like a classification artifact rather than a genuine AI supply-chain exposure, and should be deprioritized in an AI-risk register accordingly. If this software is deployed anywhere in your environment (e.g., bundled into an internal portal), patch or retire the component and treat any admin panel exposed to the internet as high-risk regardless of the AI tag; no vendor patch is referenced in available sources, so isolation/replacement is the practical mitigation.

Is CVE-2020-35276 actively exploited?

No confirmed active exploitation of CVE-2020-35276 has been reported, but organizations should still patch proactively.

How to fix CVE-2020-35276?

1) Confirm whether EgavilanMedia ECM Address Book 1.0 is deployed anywhere in the environment (it is unlikely to be part of any AI/ML stack). 2) No vendor patch is referenced in available sources — apply input validation/parameterized queries to the admin login flow, or take the application offline/replace it if patching isn't feasible. 3) Restrict network exposure of the admin login panel (VPN/allowlist). 4) Add WAF/IDS signatures for SQLi patterns targeting login parameters. 5) Audit for unexpected admin accounts as a compromise indicator. 6) Reclassify this CVE out of the AI/ML threat feed unless a genuine AI integration is confirmed.

What is the CVSS score for CVE-2020-35276?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user.

Exploitation Scenario

An attacker identifies a public-facing instance of EgavilanMedia ECM Address Book, submits a crafted SQL injection payload through the admin login form fields, and manipulates the authentication query to bypass credential checks. Once authenticated as admin, the attacker can add new privileged accounts or delete existing users, gaining persistent administrative control over the address book application and any data it manages.