CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows SQL Injection.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through <= 5.2.17.
Explanation of Vulnerability in Simple Terms
Small Package Quotes – Worldwide Express Edition versions 5.2.17 and earlier contain a SQL injection vulnerability in an unauthenticated network-accessible component. An attacker can inject malicious SQL commands to read sensitive data from the database, including customer information and configuration details. The vulnerability also allows limited disruption of service availability.
What an attacker can do
Read sensitive data from the site's database without authentication.
Potential impact on your site
Customer data, quotes, and site configuration may be exposed to unauthorized access.
Conditions required to exploit
Network access to the vulnerable component; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
