74cms - SQLi (CVE-2020-22208)

CVE-2020-22208 is a critical vulnerability in 74cms that allows for SQL injection through query manipulation in a specific backend script.

CrowdSec has been tracking this vulnerability and its exploits since 27th of March 2025.

CrowdSec network observations suggest that most exploitation of CVE-2020-22208 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2020-22208 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attempts to exploit this vulnerability typically involve requests to URLs containing /plus/ajax_street.php.