CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through <= 3.2.2.
Explanation of Vulnerability in Simple Terms
Captivate Sync versions 3.2.2 and earlier contain a SQL injection vulnerability in a network-accessible function that requires high-level privileges to exploit. An attacker with administrative or elevated access can inject malicious SQL commands to read sensitive data from the database. The vulnerability also allows limited disruption of service availability.
What an attacker can do
Read sensitive data from the database; cause limited service disruption.
Potential impact on your site
If you run Captivate Sync with admin users, an insider or compromised admin account can extract database contents.
Conditions required to exploit
Attacker must have high-level privileges (admin or equivalent) on the system.
Key dates
External resources
Related vulnerabilities
