CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CridioStudio ListingPro listingpro allows SQL Injection.This issue affects ListingPro: from n/a through <= 2.9.4.
Explanation of Vulnerability in Simple Terms
ListingPro versions 2.9.4 and earlier contain a SQL injection vulnerability that allows unauthenticated attackers to query the database directly. An attacker can extract sensitive data including user credentials and site configuration without needing to log in or interact with a user. The vulnerability affects the entire site scope and can also cause service disruption.
What an attacker can do
Extract sensitive data from the site database, including user credentials and configuration details.
Potential impact on your site
Attackers can steal user data, passwords, and site secrets without any warning or user action.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
