CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpIndeed Ultimate Learning Pro allows SQL Injection.This issue affects Ultimate Learning Pro: from n/a through 3.9.
Explanation of Vulnerability in Simple Terms
Ultimate Learning Pro versions 3.9 and earlier contain a SQL injection vulnerability in a database query that requires administrator-level access to exploit. An attacker with admin credentials can craft malicious input to read sensitive data from the database and potentially disrupt site availability. The vulnerability affects multiple components due to scope change, meaning other parts of the site may be impacted.
What an attacker can do
Read sensitive database records and cause partial site unavailability.
Potential impact on your site
Attackers with admin access can extract database contents and degrade site performance.
Conditions required to exploit
Administrator account access; no user interaction required.
Key dates
External resources
Related vulnerabilities
