CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Productive Minds Productive Commerce productive-commerce allows SQL Injection.This issue affects Productive Commerce: from n/a through <= 1.1.40.
Explanation of Vulnerability in Simple Terms
Productive Commerce versions 1.1.40 and earlier contain a SQL injection vulnerability in an unspecified component. An attacker on the network can craft malicious input to execute arbitrary SQL queries, potentially reading sensitive data from the database or disrupting service availability. No authentication is required to exploit this flaw.
What an attacker can do
Execute arbitrary SQL queries to read sensitive data or disrupt database operations.
Potential impact on your site
Attackers can access customer data, payment information, or other sensitive records stored in the database.
Conditions required to exploit
Network access to the affected Productive Commerce instance; no authentication required.
Key dates
External resources
