CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Injection.This issue affects SP Project & Document Manager: from n/a through 4.67.
Explanation of Vulnerability in Simple Terms
SP Project & Document Manager versions 4.67 and earlier contain a SQL injection vulnerability in a network-accessible component. An authenticated user with low privileges can craft malicious input to execute arbitrary SQL queries, potentially reading or modifying database contents. The vulnerability requires valid login credentials but no additional user interaction.
What an attacker can do
Read or modify database contents, including sensitive project and document data.
Potential impact on your site
Attackers with basic user accounts can extract or corrupt project data, user information, and other database records.
Conditions required to exploit
Valid login account with low-level privileges; network access to the application.
Key dates
External resources
Related vulnerabilities
