CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form.This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.
Explanation of Vulnerability in Simple Terms
Login Lockdown version 2.06 and earlier contains a SQL injection vulnerability in its database queries. An attacker with high-level site privileges can craft malicious input to execute arbitrary SQL commands, potentially reading sensitive data from the database. The vulnerability requires administrative access to exploit.
What an attacker can do
Read sensitive data from the site database by injecting SQL commands through the plugin.
Potential impact on your site
A compromised admin account could expose user data, credentials, or other sensitive database records.
Conditions required to exploit
Attacker must have high-level site privileges (administrator or equivalent role).
Key dates
External resources
Related vulnerabilities
