CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows SQL Injection.This issue affects Shipping for Nova Poshta: from n/a through <= 1.19.6.
Explanation of Vulnerability in Simple Terms
Shipping for Nova Poshta versions up to 1.19.6 contain a SQL injection vulnerability accessible over the network without authentication. An attacker can craft malicious input to extract sensitive data from the site's database or disrupt service availability. The vulnerability affects the broader system scope, potentially impacting other connected components.
What an attacker can do
Read sensitive data from the database or cause the site to become unavailable.
Potential impact on your site
Database contents may be exposed; site availability may be degraded or lost.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
