CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Injection. This issue affects eMagicOne Store Manager: from n/a through 1.3.2.
Explanation of Vulnerability in Simple Terms
eMagicOne Store Manager versions up to 1.3.2 contain a SQL injection vulnerability in an unauthenticated network-accessible component. An attacker can craft malicious input to extract sensitive data from the application's database, including user credentials and configuration details. The vulnerability requires no user interaction and can be exploited remotely without authentication.
What an attacker can do
Extract sensitive data from the database, including user credentials and site configuration.
Potential impact on your site
Attackers can read database contents without logging in, potentially exposing customer data, admin credentials, and business information.
Conditions required to exploit
Network access to the vulnerable application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
