CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in susheelhbti Saksh Escrow System saksh-escrow-system allows SQL Injection.This issue affects Saksh Escrow System: from n/a through <= 2.4.
Explanation of Vulnerability in Simple Terms
Saksh Escrow System versions 2.4 and earlier contain a SQL injection vulnerability in a network-accessible function that requires low-level authentication. An attacker with a valid user account can inject malicious SQL commands to read sensitive data from the database. The vulnerability also allows limited disruption of service. No integrity compromise is possible.
What an attacker can do
Read sensitive data from the database by injecting SQL commands into a vulnerable parameter.
Potential impact on your site
Unauthorized access to database contents including user data, transaction records, and other sensitive information stored in the escrow system.
Conditions required to exploit
Attacker must have a valid user account on the system; no user interaction required.
Key dates
External resources
Related vulnerabilities
