CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL Injection.This issue affects Slimstat Analytics: from n/a through 5.0.4.
Explanation of Vulnerability in Simple Terms
Slimstat Analytics versions up to 5.0.4 contain a SQL injection vulnerability that can be triggered when a user visits a malicious link. An attacker can read sensitive data from the site's database, modify records, or disrupt service. The vulnerability requires user interaction but can affect the entire site if the database contains multi-tenant data.
What an attacker can do
Read, modify, or delete data in the site's database by injecting SQL commands through a crafted link.
Potential impact on your site
Database contents (user data, posts, settings) can be exposed, altered, or deleted without authorization.
Conditions required to exploit
A site admin or user must click a malicious link; no prior authentication required.
Key dates
External resources
Related vulnerabilities
