CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebbyTemplate Office Locator office-locator allows SQL Injection.This issue affects Office Locator: from n/a through <= 1.3.0.
Explanation of Vulnerability in Simple Terms
Office Locator versions 1.3.0 and earlier contain a SQL injection vulnerability in database query handling. An attacker can craft malicious input to execute arbitrary SQL commands, potentially reading sensitive data from the database or disrupting site availability. No authentication is required. Update to a version newer than 1.3.0 immediately.
What an attacker can do
Execute SQL commands to read database contents or cause the database to become unavailable.
Potential impact on your site
Attackers can steal sensitive data from your database or make your site unstable without needing to log in.
Conditions required to exploit
Network access to the vulnerable component; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
