SQL Injection Vulnerability in Multi Step for Contact Form

CVE-2024-47331

Summary

A vulnerability exists in NinjaTeam's Multi Step for Contact Form plugin that enables SQL Injection due to improper neutralization of special elements used in SQL commands. This flaw can be exploited by attackers to gain unauthorized access to the underlying database, potentially leading to the exposure of sensitive information or further attacks on the affected system. The issue impacts versions up to 2.7.7, necessitating immediate action from users to secure their applications against possible exploitation.

References