CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows SQL Injection.This issue affects Contact Form to Any API: from n/a through 1.1.2.
Explanation of Vulnerability in Simple Terms
Contact Form to Any API versions up to 1.1.2 contain a SQL injection vulnerability accessible to high-privilege users. An attacker with administrative access can inject malicious SQL through form parameters, potentially reading sensitive database records. The vulnerability affects the scope beyond the vulnerable component itself.
What an attacker can do
Read sensitive data from the site's database by injecting SQL commands through form fields.
Potential impact on your site
A compromised admin account could expose your database contents, including user data and configuration secrets.
Conditions required to exploit
Attacker must have high-level administrative privileges on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
