CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.
Explanation of Vulnerability in Simple Terms
MasterStudy LMS versions up to 3.7.29 contain a SQL injection vulnerability in a component accessible to authenticated users. An attacker with low-level account access can craft malicious input to extract sensitive data from the database or disrupt site availability. The vulnerability affects multiple users and systems connected to the LMS.
What an attacker can do
Extract sensitive data from the database or cause service disruption via SQL injection.
Potential impact on your site
Unauthorized access to student records, course data, and user credentials; potential site downtime.
Conditions required to exploit
Attacker must have a low-privilege user account on the LMS.
Key dates
External resources
Related vulnerabilities
