CVE-2020-37110 is a SQL injection in 60CycleCMS 2.5.2, scored 8.2 (high). Unvalidated input in news.php and common/lib.php, such as the title parameter, reaches a database query. The record names no fixed version, so replace the CMS or patch the queries and keep it off the open internet.
What's affected
The record lists 60CycleCMS 2.5.2 from opensourcecms. The code involved is news.php and the shared library file common/lib.php. Query parameters such as title are named as examples. The record notes that the issue does not involve cross site scripting.
The CVSS vector is AV:N/AC:L/PR:N/UI:N. No fixed release is named.
How to check if you're exposed
60CycleCMS is a flat application with no package manager metadata, so check it by hand.
- Look for a directory containing news.php and common/lib.php, and read the version in the admin screen or the footer.
- Search common/lib.php for queries that build text from request values.
- Review access logs for requests to news.php with unusual title values.
- Confirm whether the site is public.
What to do now
- Locate every 60CycleCMS site you run.
- Put public sites behind a firewall rule or take them offline until patched.
- Replace string built queries with prepared statements in the shared library, which fixes every caller at once.
- Consider moving to an actively maintained CMS.
- Reset administrator passwords if the site has been public.
Why it matters
The weakness is CWE-89, SQL injection. The application builds a database query by putting request data straight into the query text. The database cannot tell which part is the developer's instruction and which part came from the visitor, so crafted input can change what the query does.
The vulnerable code sits in a shared library file, so the query helper is likely used by several pages. Fixing the helper once is more effective than fixing one parameter at a time.
The fix for this class is well understood. Use parameterized queries or prepared statements so that input is always treated as data, validate values against an allowlist where only a few are valid, and give the application database account only the rights it needs. None of this is complicated, but it has to be applied to every query in the code base, which is why one reported parameter is often a sign of others.
Quick check
Does this involve cross site scripting?
No. The record states explicitly that the issue does not involve cross site scripting. It is a database query problem.
Sources
- OpenSourceCMS listing referenced by the record
- VulnCheck advisory
- Exploit-DB entry referenced by the record
Last reviewed: 19 October 2026.
