CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows SQL Injection.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.
Explanation of Vulnerability in Simple Terms
Ultimate Push Notifications versions 1.2.0 and earlier contain a SQL injection vulnerability accessible to authenticated users with low privileges. An attacker can craft malicious input to extract sensitive data from the site database, including user credentials and configuration details. The vulnerability affects the entire application scope due to database access. Update to a version newer than 1.2.0 immediately.
What an attacker can do
Read sensitive data from the site database, including user credentials and site configuration.
Potential impact on your site
User passwords, email addresses, and other database records can be exposed to authenticated attackers.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
