SQL Injection Vulnerability in Contact Form to DB
CVE-2024-35678

8.8HIGH

Key Information:

Vendor

WordPress
Status
Contact Form To Db By Bestwebsoft
Vendor
CVE Published:
8 June 2024

What is CVE-2024-35678?

An SQL Injection vulnerability exists in the Contact Form to DB by BestWebSoft, where improperly neutralized special elements in SQL commands can be exploited by attackers. This security flaw allows unauthorized individuals to manipulate database queries, potentially leading to unauthorized data access or modification. All users of the affected versions, ranging from n/a through 1.7.2, should take immediate action to mitigate the risks associated with this vulnerability.

Affected Version(s)

Contact Form to DB by BestWebSoft <= 1.7.2

References

https://patchstack.com/database/vulnerability/contact-for...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Do Truong Giang (Patchstack Alliance)
.