CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.4.01.
Explanation of Vulnerability in Simple Terms
The 5 Stars Rating Funnel plugin contains a SQL injection vulnerability in versions up to 1.4.01. An authenticated user with low privileges can craft malicious input to execute arbitrary SQL queries against the site database. This allows reading sensitive data and potentially modifying database records. The vulnerability requires network access and an active user account but no additional user interaction.
What an attacker can do
Read sensitive database records and modify or delete data via SQL injection.
Potential impact on your site
Unauthorized access to database contents, potential data loss, and site instability if database records are modified.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
