CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP smtp-sendinblue allows SQL Injection.This issue affects YaySMTP: from n/a through <= 1.3.
Explanation of Vulnerability in Simple Terms
YaySMTP versions 1.3 and earlier contain a SQL injection vulnerability in database query handling. An attacker with high-level privileges can inject malicious SQL code to read sensitive data from the database. The vulnerability affects the entire application scope and may impact site availability. Update to version 2.7.5 or later to remediate.
What an attacker can do
Read sensitive data from the site's database and potentially degrade site performance.
Potential impact on your site
A compromised admin account could expose database contents including user data, credentials, and configuration.
Conditions required to exploit
Attacker must have high-level administrative or privileged account access to the site.
Key dates
External resources
Related vulnerabilities
