CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through <= 3.9.25.
Explanation of Vulnerability in Simple Terms
Simple Download Monitor versions 3.9.25 and earlier contain a SQL injection vulnerability accessible to high-privilege users. An attacker with admin or equivalent access can inject malicious SQL commands through unfiltered input, potentially reading sensitive database records. The vulnerability also allows limited disruption of site availability. Patched versions are not yet publicly documented.
What an attacker can do
Read sensitive data from the site database if they have admin-level access.
Potential impact on your site
Admin accounts are at risk of data theft; verify no unauthorized admin accounts exist and review database access logs.
Conditions required to exploit
Attacker must have high-privilege account access (admin or equivalent role).
Key dates
External resources
Related vulnerabilities
