CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager: from n/a through 4.69.
Explanation of Vulnerability in Simple Terms
SP Project & Document Manager versions up to 4.69 contain a SQL injection vulnerability in a network-accessible function that requires low-level authentication. An attacker with a valid user account can inject malicious SQL queries to read sensitive data from the database. The vulnerability also allows limited disruption of service. Scope is changed, meaning the impact may extend beyond the vulnerable component.
What an attacker can do
Read sensitive data from the database by injecting SQL commands into a vulnerable query parameter.
Potential impact on your site
Unauthorized database access and potential data breach affecting all stored project and document information.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges and network access to the application.
Key dates
External resources
Related vulnerabilities
