CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through <= 3.4.2.
Explanation of Vulnerability in Simple Terms
Vitepos versions 3.4.2 and earlier contain a SQL injection vulnerability in an authenticated context. A logged-in user with low privileges can craft malicious input to execute arbitrary SQL queries, potentially reading sensitive database records. The vulnerability affects confidentiality severely and can degrade system availability. Update to a version newer than 3.4.2.
What an attacker can do
Read sensitive database records and degrade system availability by injecting SQL commands.
Potential impact on your site
Unauthorized access to database contents and potential service disruption if the site runs Vitepos.
Conditions required to exploit
Attacker must be logged in with low-level user privileges and have network access to the application.
Key dates
External resources
Related vulnerabilities
