CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer allows Blind SQL Injection.This issue affects MyStyle Custom Product Designer: from n/a through <= 3.21.1.
Explanation of Vulnerability in Simple Terms
MyStyle Custom Product Designer versions up to 3.21.1 contain a SQL injection vulnerability in unauthenticated requests. An attacker can query the database directly to extract sensitive data, including user information and site configuration. The vulnerability requires no authentication or user interaction, making it trivial to exploit remotely.
What an attacker can do
Extract sensitive data from the site database, including user credentials and configuration details.
Potential impact on your site
User data and site configuration exposed; attackers can read password hashes, email addresses, and other stored information.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
