CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedNao Donations Made Easy – Smart Donations allows SQL Injection.This issue affects Donations Made Easy – Smart Donations: from n/a through 4.0.12.
Explanation of Vulnerability in Simple Terms
Donations Made Easy – Smart Donations versions up to 4.0.12 contain a SQL injection vulnerability accessible to high-privilege users. An attacker with admin or elevated permissions can craft malicious input to execute arbitrary SQL queries, potentially reading sensitive donation and user data. The vulnerability requires high-level access and does not allow data modification, but can impact site confidentiality and availability.
What an attacker can do
Read sensitive database records including donation and user information via SQL injection.
Potential impact on your site
Donation records, user data, and other sensitive database information could be exposed to privileged users with malicious intent.
Conditions required to exploit
Attacker must have high-level admin or elevated user privileges on the site.
Key dates
External resources
Related vulnerabilities
