CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows SQL Injection.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.25.08.
Explanation of Vulnerability in Simple Terms
EZ SQL Reports Shortcode Widget and DB Backup versions 5.25.08 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can trick a site administrator into performing unwanted actions—such as modifying reports or triggering database backups—by crafting a malicious link or page. The vulnerability requires the admin to visit the attacker's page while logged in, and can expose sensitive database information or degrade site availability.
What an attacker can do
Trick an admin into modifying reports, triggering backups, or changing plugin settings without their knowledge.
Potential impact on your site
Unauthorized changes to reports or database backups; potential exposure of sensitive data or site downtime.
Conditions required to exploit
Admin must be logged in and visit a page controlled by the attacker (e.g., click a malicious link).
Key dates
External resources
Related vulnerabilities
