CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.4.
Explanation of Vulnerability in Simple Terms
APIExperts Square for WooCommerce versions up to 4.7.4 contain a SQL injection vulnerability in database query handling. An authenticated user with low privileges can inject malicious SQL code to read sensitive data from the database, including customer information and payment records. The vulnerability affects the entire site scope and may also cause service disruption.
What an attacker can do
Read sensitive data from the site database, including customer records and payment information.
Potential impact on your site
Customer data, payment records, and other sensitive database information could be exposed to authenticated attackers.
Conditions required to exploit
Attacker must have a low-privilege user account (e.g., customer or subscriber role) on the WooCommerce site.
Key dates
External resources
Related vulnerabilities
