LiveActive security incident?Get immediate response
CVE Record

CVE-2020-22210: SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-22210 describes a SQL injection issue in 74cms 3.2.0 involving the x parameter in ajax_officebuilding.php. If an exposed system is running this version, the issue may affect database confidentiality or integrity. The public source bundle does not provide CVSS, confirmed impact details, or a vendor fix.

Executive priority

Prioritize assessment if 74cms 3.2.0 is externally reachable or supports business-critical workflows. The vulnerability class can be serious, but the public record lacks severity scoring and exploitation evidence, so urgency depends on confirmed exposure.

Technical view

The record identifies SQL injection in 74cms 3.2.0 through the x parameter passed to ajax_officebuilding.php. The source bundle does not include CWE mapping, vulnerable CPEs, patched versions, exploit prerequisites, or proof of active exploitation. Treat affected internet-facing deployments as needing investigation until vendor guidance or code review confirms remediation.

Likely exposure

Exposure is most likely limited to organizations running 74cms 3.2.0, especially if ajax_officebuilding.php is reachable from untrusted networks. The official affected-product metadata is incomplete in the provided bundle, so version confirmation is essential.

Exploitation context

The CVE is not listed as KEV in the provided bundle. The sources identify a public vulnerability report, but they do not establish active exploitation, exploit maturity, authentication requirements, or reliable exploitation conditions.

Researcher notes

The source bundle is sparse: no CVSS vector, CWE, CPE, patch version, or vendor advisory is provided. The key research task is to validate affected code paths and determine whether upstream fixed the issue after the public GitHub report.

Mitigation direction

  • Identify any deployed 74cms instances and confirm exact versions.
  • Check 74cms or maintainer guidance for a fixed release or official workaround.
  • Limit public access to affected administrative or AJAX endpoints where operationally feasible.
  • Review server logs for unusual requests to ajax_officebuilding.php.
  • Apply secure database query handling if maintaining patched internal code.

Validation and detection

  • Inventory web assets for 74cms and confirm whether version 3.2.0 is present.
  • Verify whether ajax_officebuilding.php is reachable from the internet or partner networks.
  • Review application code for unsafe handling of the x parameter.
  • Check database and web logs for suspicious parameter activity.
  • Confirm remediation against vendor guidance before closing the finding.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Database behavior lookup

The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-22210 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.