CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injection.This issue affects Email posts to subscribers: from n/a through 6.2.
Explanation of Vulnerability in Simple Terms
Email posts to subscribers versions up to 6.2 contain a SQL injection vulnerability in database query handling. An attacker can craft a malicious request that, when a site visitor clicks a link or visits a page, executes arbitrary SQL commands. This can expose sensitive data from the site's database. The vulnerability requires no authentication but does require user interaction.
What an attacker can do
Read or modify data in the site's database by injecting SQL commands through a crafted request.
Potential impact on your site
Attackers can steal user data, email addresses, or other sensitive information stored in your database.
Conditions required to exploit
A site visitor must click a malicious link or visit an attacker-controlled page; no login required.
Key dates
External resources
Related vulnerabilities
