CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows SQL Injection.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.7.9.7.
Explanation of Vulnerability in Simple Terms
Zoho CRM Lead Magnet versions up to 1.7.9.7 contain a SQL injection vulnerability accessible to authenticated users. An attacker with low-level access can craft malicious input to query or modify the database, potentially exposing sensitive lead data or disrupting service availability. The vulnerability affects the entire application scope due to database access.
What an attacker can do
Read or modify database records, including sensitive lead information and customer data.
Potential impact on your site
Unauthorized access to lead records, customer data theft, or database corruption affecting CRM operations.
Conditions required to exploit
Attacker must have a valid Zoho CRM account with low-level user privileges; no user interaction required.
Key dates
External resources
Related vulnerabilities
