CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chenyenming Woocommerce Quote Calculator woo-quote-calculator-order allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through <= 1.1.
Explanation of Vulnerability in Simple Terms
Woocommerce Quote Calculator versions 1.1 and earlier contain a SQL injection vulnerability in database query handling. An attacker with low-level user access can inject malicious SQL commands to read sensitive data from the site's database, including customer information and configuration details. The vulnerability affects the scope beyond the vulnerable component itself.
What an attacker can do
Read sensitive data from the site database, including customer records and site configuration.
Potential impact on your site
Customer data, order information, and site configuration may be exposed to authenticated attackers.
Conditions required to exploit
Attacker must have a low-level user account (e.g., customer or subscriber role) on the site.
Key dates
External resources
Related vulnerabilities
