CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This issue affects Onepage Builder: from n/a through 2.4.1.
Explanation of Vulnerability in Simple Terms
Onepage Builder versions up to 2.4.1 contain a SQL injection vulnerability in a high-privilege function. An authenticated administrator can craft malicious input to execute arbitrary SQL queries, potentially reading or modifying the site database. The vulnerability requires admin-level access and does not affect site availability.
What an attacker can do
Read or modify database contents via SQL injection.
Potential impact on your site
A compromised admin account can extract sensitive data or alter site configuration and user records.
Conditions required to exploit
Administrator account access; no user interaction required.
Key dates
External resources
Related vulnerabilities
