CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Propovoice Propovoice Pro allows SQL Injection.This issue affects Propovoice Pro: from n/a through 1.7.0.3.
Explanation of Vulnerability in Simple Terms
Propovoice Pro versions up to 1.7.0.3 contain a SQL injection vulnerability in an unauthenticated network-accessible endpoint. An attacker can craft malicious input to extract sensitive data from the application's database, including user credentials and configuration details. The vulnerability requires no user interaction and can be exploited remotely without authentication.
What an attacker can do
Extract sensitive data from the database, including user credentials and site configuration.
Potential impact on your site
Attackers can read user accounts, passwords, and private data stored in the database without logging in.
Conditions required to exploit
Network access to the Propovoice Pro application; no authentication required.
Key dates
External resources
Related vulnerabilities
