CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Castos Seriously Simple Stats allows SQL Injection.This issue affects Seriously Simple Stats: from n/a through 1.5.0.
Explanation of Vulnerability in Simple Terms
Seriously Simple Stats versions up to 1.5.0 contain a SQL injection vulnerability in a database query that accepts user input without proper sanitization. An attacker with low-level site access can craft malicious input to extract sensitive data from the database or disrupt site availability. The vulnerability affects multiple users and components due to scope change.
What an attacker can do
Extract sensitive data from the site database or cause the site to become unavailable.
Potential impact on your site
Unauthorized users with basic site access can read private data or crash the database, affecting all site visitors.
Conditions required to exploit
Attacker must have a low-level user account (subscriber or contributor role) on the site.
Key dates
External resources
Related vulnerabilities
