CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login.This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.5.
Explanation of Vulnerability in Simple Terms
RegistrationMagic versions up to 5.2.4.5 contain a SQL injection vulnerability in database queries. An attacker with high-level privileges can inject malicious SQL code to read sensitive data from the database. The vulnerability requires administrative access to exploit and does not allow data modification, but can expose user information and site configuration details.
What an attacker can do
Read sensitive data from the site's database, including user information and configuration details.
Potential impact on your site
User data and site configuration stored in the database could be exposed to administrators with malicious intent.
Conditions required to exploit
Attacker must have high-level administrative privileges on the site.
Key dates
External resources
Related vulnerabilities
