CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through <= 3.0.7.
Explanation of Vulnerability in Simple Terms
Collapsing Archives versions 3.0.7 and earlier contain a SQL injection vulnerability in database query handling. An attacker with low-level user privileges can inject malicious SQL commands to read sensitive data from the site's database, including user information and configuration details. The vulnerability affects the entire application scope and may impact site availability.
What an attacker can do
Read sensitive data from the site database, including user records and configuration information.
Potential impact on your site
Unauthorized access to database contents, potential exposure of user credentials and private data, possible service disruption.
Conditions required to exploit
Attacker must have a low-level user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
