CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.
Explanation of Vulnerability in Simple Terms
Fancy Product Designer versions 6.4.3 and earlier contain a SQL injection vulnerability in the product designer component. An attacker can craft malicious input to execute arbitrary SQL queries against the site's database without authentication. This allows reading sensitive data and potentially disrupting database operations. Update to a version newer than 6.4.3 immediately.
What an attacker can do
Execute SQL queries to read database contents, including user data and configuration secrets.
Potential impact on your site
Attackers can steal customer data, user credentials, and site configuration without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
