CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 21.3.4.
Explanation of Vulnerability in Simple Terms
Contest Gallery versions 21.3.4 and earlier contain a SQL injection vulnerability in database queries. An attacker with low-level user access can craft malicious input to extract sensitive data from the database or disrupt site availability. The vulnerability affects multiple database operations and can impact confidentiality and availability of the application.
What an attacker can do
Read sensitive data from the database or cause the site to become unavailable.
Potential impact on your site
Unauthorized database access, data theft, or service disruption affecting all site users.
Conditions required to exploit
Attacker must have a low-level user account on the site.
Key dates
External resources
Related vulnerabilities
