CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows SQL Injection.This issue affects Simple Business Directory Pro: from n/a through <= 15.9.4.
Explanation of Vulnerability in Simple Terms
Simple Business Directory Pro versions up to 15.9.4 contain a SQL injection vulnerability in database query handling. An attacker can craft malicious input to extract sensitive data from the site's database without authentication. The vulnerability also allows limited disruption of database availability. Update to a version newer than 15.9.4 immediately.
What an attacker can do
Extract sensitive data from the site database, including user information and business listings.
Potential impact on your site
Attacker can read all database contents and potentially disrupt site availability without logging in.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
