CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.5.
Explanation of Vulnerability in Simple Terms
NEX-Forms versions up to 8.5.5 contain a SQL injection vulnerability that allows authenticated administrators to read sensitive database information. An attacker with admin privileges can craft malicious input to extract data from the database. The vulnerability requires high-level access and does not allow data modification, but can impact site confidentiality and availability.
What an attacker can do
Read sensitive data from the site's database by injecting SQL commands through form inputs.
Potential impact on your site
An admin account compromise could expose your database contents, including user data and configuration secrets.
Conditions required to exploit
Attacker must have administrator-level access to the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
