CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshipping-and-fulfillment allows SQL Injection.This issue affects Zendrop – Global Dropshipping: from n/a through 1.0.0.
Explanation of Vulnerability in Simple Terms
Zendrop – Global Dropshipping versions up to 1.0.0 contain a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries against the application's database. No user interaction is required. An attacker can read, modify, or delete sensitive data, or disrupt service availability.
What an attacker can do
Execute arbitrary SQL commands to read, modify, or delete database records without authentication.
Potential impact on your site
Complete compromise of the database: attackers can steal customer data, modify orders, or take the site offline.
Conditions required to exploit
Network access to the vulnerable application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
