CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.6.27.
Explanation of Vulnerability in Simple Terms
MasterStudy LMS versions up to 3.6.27 contain a SQL injection vulnerability in a high-privilege function. An authenticated administrator can craft malicious input to extract or modify database records. The vulnerability requires admin-level access and does not affect data integrity directly, but allows unauthorized data disclosure and partial service disruption.
What an attacker can do
Read sensitive data from the site database or cause temporary service degradation.
Potential impact on your site
An admin account compromise could expose student records, course data, and other sensitive information stored in your database.
Conditions required to exploit
Attacker must have administrator-level access to the LMS.
Key dates
External resources
Related vulnerabilities
