CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in facturaone TicketBAI Facturas para WooCommerce wp-ticketbai allows Blind SQL Injection.This issue affects TicketBAI Facturas para WooCommerce: from n/a through <= 3.19.
Explanation of Vulnerability in Simple Terms
TicketBAI Facturas para WooCommerce versions 3.19 and earlier contain a SQL injection vulnerability in the plugin's database query handling. An attacker can inject malicious SQL code through unfiltered input to read sensitive data from the site's database, including customer information and payment records. The vulnerability requires no authentication and can be exploited remotely over the network.
What an attacker can do
Read sensitive data from the site's database, including customer records and payment information.
Potential impact on your site
Customer data, payment records, and other sensitive database information may be exposed to unauthorized access.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
