CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tenteeglobal Instant Appointment instant-appointment allows SQL Injection.This issue affects Instant Appointment: from n/a through <= 1.2.
Explanation of Vulnerability in Simple Terms
Instant Appointment versions 1.2 and earlier contain a SQL injection vulnerability in the application's database query handling. An attacker can inject malicious SQL commands through user input to read sensitive data from the database, including user credentials and appointment records. The vulnerability requires no authentication and can be exploited remotely over the network.
What an attacker can do
Read sensitive data from the application database, including user credentials and appointment information.
Potential impact on your site
User data, credentials, and appointment records may be exposed to unauthorized access.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
