CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows SQL Injection.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.1.
Explanation of Vulnerability in Simple Terms
Paid Member Subscriptions versions up to 2.15.1 contain a SQL injection vulnerability in database query handling. An attacker with network access can craft malicious input to extract sensitive data from the site's database, including user credentials and subscription information. The vulnerability requires specific conditions to exploit but can compromise confidentiality across the entire application.
What an attacker can do
Extract sensitive data from the site's database, including user credentials and subscription records.
Potential impact on your site
User data, passwords, and subscription information may be exposed to unauthorized access.
Conditions required to exploit
Network access; no authentication or user interaction required, but exploitation requires specific technical conditions.
Key dates
External resources
