Security readout for executives and security teams
Plain-English summary
CVE-2020-24770 is a reported SQL injection issue in NexusPHP 1.5. A remote attacker may be able to manipulate the id parameter in modrules.php to run arbitrary database commands. Business urgency depends on whether NexusPHP 1.5 is deployed and reachable.
Executive priority
Prioritize quickly if NexusPHP 1.5 is internet-facing or handles sensitive user data. If NexusPHP is not present, no direct exposure is indicated by the provided sources.
Technical view
The CVE record describes SQL injection in modrules.php in NexusPHP 1.5 via the id parameter, allowing arbitrary SQL commands. The bundle provides no CVSS score, CWE mapping, CPE data, or confirmed vendor fix details. Treat exposure assessment as product-and-version specific.
Likely exposure
Exposure is likely limited to organizations running NexusPHP 1.5 with modrules.php accessible. The source bundle does not identify CPEs, hosting patterns, authentication requirements, or broader affected versions, so asset validation is required before prioritizing remediation.
Exploitation context
CISA KEV status is false in the bundle, and no provided source states active exploitation. Public references exist, including a GitHub CVE write-up, but this analysis does not rely on or provide exploit procedure details.
Researcher notes
Evidence is sparse: no CVSS, CWE, CPEs, exploit status, or clear fixed-version statement is included. The strongest claim is the CVE description: remote SQL injection through modrules.php id in NexusPHP 1.5.
Mitigation direction
- Inventory any NexusPHP deployments and confirm exact version.
- Check NexusPHP project guidance for fixed releases or official remediation.
- Limit access to modrules.php until vendor guidance is applied.
- Review web application logs for unusual modrules.php id parameter activity.
- Back up and review database integrity if exposure is confirmed.
Validation and detection
- Search asset inventory for NexusPHP 1.5 deployments.
- Confirm whether modrules.php is reachable from untrusted networks.
- Review source or vendor notes for id parameter handling changes.
- Check WAF and application logs for suspicious requests to modrules.php.
- Document whether authentication is required in the local deployment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-24770 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/burpheart/CVE/2020-08-13-02.mdCVE reference · x_refsource_MISC
- https://nexusphp.org/2021/02/03/nexusphp-v1-6-0-beta2/CVE reference · x_refsource_MISC
- https://github.com/burpheart/CVE/blob/master/2020-08-13-02.mdCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.