CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows SQL Injection.This issue affects Distance Based Shipping Calculator: from n/a through <= 2.0.23.
Explanation of Vulnerability in Simple Terms
The Distance Based Shipping Calculator plugin contains a SQL injection vulnerability in versions up to 2.0.23. An authenticated user with low privileges can inject malicious SQL commands through unfiltered input, potentially reading sensitive database information. The vulnerability affects the entire site scope and may also cause service disruption.
What an attacker can do
Read sensitive data from the site's database, such as user information or configuration details.
Potential impact on your site
Unauthorized access to database contents; potential data breach affecting customer or user records.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or customer role).
Key dates
External resources
Related vulnerabilities
