CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Quiz Maker quiz-maker allows SQL Injection.This issue affects Quiz Maker: from n/a through <= 6.6.8.7.
Explanation of Vulnerability in Simple Terms
Ays Pro Quiz Maker versions up to 6.6.8.7 contain a SQL injection vulnerability that allows attackers to read sensitive data from the site's database. The vulnerability requires user interaction—typically clicking a malicious link—and affects the scope beyond the vulnerable component. No authentication is required to exploit it.
What an attacker can do
Read sensitive data from the site's database, such as user credentials or quiz responses.
Potential impact on your site
Attackers can extract user data, quiz answers, and other database records without needing site access.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page; no login required.
Key dates
External resources
Related vulnerabilities
