CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager.This issue affects SP Project & Document Manager : from n/a through 4.71.
Explanation of Vulnerability in Simple Terms
SP Project & Document Manager versions up to 4.71 contain a SQL injection vulnerability in a network-accessible function that requires high-level privileges to exploit. An authenticated administrator can craft malicious input to read or modify database contents. The vulnerability affects the confidentiality and availability of the application.
What an attacker can do
Read or modify database records by injecting SQL commands through an authenticated administrative function.
Potential impact on your site
An admin account compromise could expose sensitive project and document data, or corrupt database records.
Conditions required to exploit
Attacker must have administrator-level access to the application; no user interaction required.
Key dates
External resources
Related vulnerabilities
