CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.6.1.
Explanation of Vulnerability in Simple Terms
Barcode Scanner with Inventory & Order Manager versions 1.6.1 and earlier contain a SQL injection vulnerability accessible to authenticated users. An attacker with low-level account access can inject malicious SQL commands to read sensitive database information. The vulnerability affects the entire application scope and may allow data exfiltration or service disruption.
What an attacker can do
Read sensitive data from the database by injecting SQL commands through the application.
Potential impact on your site
Unauthorized database access and potential data breach affecting all application data and users.
Conditions required to exploit
Attacker must have a low-privilege user account on the application.
Key dates
External resources
Related vulnerabilities
