SQL Injection Vulnerability Affects ProfileGrid

CVE-2024-30491

Summary

An SQL Injection vulnerability exists in the ProfileGrid plugin developed by Metagauss, which enables attackers to manipulate SQL queries executed by the application. This flaw occurs due to improper neutralization of special elements used in SQL commands, allowing malicious users to execute arbitrary SQL statements. Consequently, attackers can potentially access sensitive data, compromise user accounts, or disrupt the normal operation of affected installations. The issue is applicable to all versions of ProfileGrid up to and including version 5.7.8.

References