Administrator SQL Injection Vulnerability in FAQ Manager <= 2.0.3 Versions
CVE-2024-32136
7.6HIGH
Summary
Xenioushk BWL Advanced FAQ Manager has a SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw allows an attacker to execute unauthorized SQL queries, potentially leading to unauthorized data access, data manipulation, and a full compromise of the affected system. Versions affected include all releases up to 2.0.3. It's crucial for users of the BWL Advanced FAQ Manager to patch their installations to mitigate risk and secure their databases against potential exploitation.
Affected Version(s)
BWL Advanced FAQ Manager <= 2.0.3
References
CVSS V3.1
Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ivan Spiridonov (Patchstack Alliance)