CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system allows SQL Injection.This issue affects Course Booking System: from n/a through <= 6.0.6.
Explanation of Vulnerability in Simple Terms
The Course Booking System contains a SQL injection vulnerability in versions up to 6.0.6. An attacker can craft malicious input to execute arbitrary SQL queries against the database, potentially reading sensitive booking and user data. No authentication is required. The vulnerability also impacts system availability.
What an attacker can do
Execute SQL queries to read or modify database records without authentication.
Potential impact on your site
Attackers can steal booking data, user information, and payment details; may also disrupt service availability.
Conditions required to exploit
Network access to the vulnerable application; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
