CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.
Explanation of Vulnerability in Simple Terms
Hydra Booking versions up to 1.1.10 contain a SQL injection vulnerability in a database query that requires low-level authentication to exploit. An attacker with a user account can craft malicious input to read sensitive data from the database or disrupt service availability. The vulnerability affects multiple systems if the booking component is integrated across a network.
What an attacker can do
Read sensitive database records and cause service disruption by injecting SQL commands.
Potential impact on your site
Unauthorized access to booking data, customer information, and potential downtime if the database is disrupted.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
