Security readout for executives and security teams
Plain-English summary
This CVE reports SQL injection in 74cms 3.2.0 through the id parameter on wap/wap-company-show.php. SQL injection can expose or alter database content, but the bundle provides no CVSS score, vendor advisory, patch details, or confirmed exploitation evidence.
Executive priority
Treat this as a potentially serious application risk where 74cms 3.2.0 is exposed, but prioritize based on confirmed deployment and reachability because severity and exploitation evidence are incomplete.
Technical view
The public record describes an SQL injection affecting 74cms 3.2.0 in wap/wap-company-show.php through the id parameter. The CVE metadata is sparse: no CVSS, CWE, CPE, or fixed version is provided. The only listed external reference is a GitHub issue.
Likely exposure
Likely exposure is limited to organizations running 74cms 3.2.0 with the WAP company-show page reachable, especially from the internet. The affected-product metadata is incomplete, so inventory confirmation is required.
Exploitation context
The bundle does not show CISA KEV listing or any cited evidence of active exploitation. The public reference may describe the vulnerability, but no exploitation-in-the-wild claim is provided here.
Researcher notes
The record is minimal and lacks scoring, CPEs, impact detail, and remediation data. Analysis should stay anchored to confirmed 74cms 3.2.0 exposure and the named route/parameter, with no assumption of broader version impact.
Mitigation direction
- Check 74cms vendor guidance for affected versions and fixed releases.
- Upgrade only to a vendor-supported fixed version once identified.
- Restrict external access to the affected WAP route where feasible.
- Review WAF or application filtering for suspicious id-parameter patterns.
- Monitor database and web logs for abnormal requests to the route.
Validation and detection
- Inventory all 74cms deployments and confirm exact version numbers.
- Check whether wap/wap-company-show.php is present and reachable.
- Review recent web logs for unusual requests to that endpoint.
- Confirm whether a vendor advisory or fixed release exists.
- Document any internet-facing exposure for remediation tracking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-22212 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/blindkey/cve_like/issues/14CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.