CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.1.
Explanation of Vulnerability in Simple Terms
APIExperts Square for WooCommerce versions up to 4.7.1 contain a SQL injection vulnerability in database query handling. An authenticated user with low privileges can inject malicious SQL code to read sensitive data from the site's database, including customer information and payment records. The vulnerability affects the scope beyond the vulnerable component itself.
What an attacker can do
Read sensitive data from the site database, including customer records and payment information.
Potential impact on your site
Customer data, payment records, and other sensitive database information could be exposed to authenticated attackers.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
