CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can send GET requests with crafted SQL payloads in the aid parameter to extract sensitive database information including user credentials and table contents.
Explanation of Vulnerability in Simple Terms
PICA Photo Gallery contains a SQL injection vulnerability in its database query handling. An attacker can inject malicious SQL commands through user-supplied input to read, modify, or delete database contents without authentication. This affects all versions from 1.0 onwards. Update to a patched version when available from the vendor.
What an attacker can do
Read, modify, or delete database records by injecting SQL commands through the application.
Potential impact on your site
Attackers can steal user data, modify site content, or destroy the database without logging in.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
