CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adrian Tobey FormLift for Infusionsoft Web Forms allows Blind SQL Injection.This issue affects FormLift for Infusionsoft Web Forms: from n/a through 7.5.17.
Explanation of Vulnerability in Simple Terms
FormLift for Infusionsoft Web Forms versions 7.5.17 and earlier contain a SQL injection vulnerability that allows unauthenticated attackers to read sensitive data from the database without user interaction. The vulnerability affects the web form processing logic and can also cause partial service disruption. No authentication or special privileges are required to exploit this issue.
What an attacker can do
Read sensitive data from the site's database, including user information and configuration details.
Potential impact on your site
Attackers can extract database contents without logging in, potentially exposing user data and site configuration.
Conditions required to exploit
Network access to the affected FormLift form; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
