CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+) SQL Injection.This issue affects GD Security Headers: from n/a through 1.7.
Explanation of Vulnerability in Simple Terms
GD Security Headers versions up to 1.7 contain a SQL injection vulnerability accessible to high-privilege users. An attacker with administrative access can inject malicious SQL through the plugin's input handling, potentially reading sensitive database information. The vulnerability affects confidentiality and availability but not data integrity.
What an attacker can do
Read sensitive data from the site's database or degrade database performance.
Potential impact on your site
An admin account compromise could expose your database contents or cause performance degradation.
Conditions required to exploit
Attacker must have high-level administrative privileges on the site.
Key dates
External resources
Related vulnerabilities
