title: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Crafter Studio
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crafter Studio on Linux, MacOS, Windows, x86, ARM, 64 bit allows SQL Injection.This issue affects CrafterCMS v4.0 from 4.0.0 through 4.0.1, and v3.1 from 3.1.0 through 3.1.26.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
defaultStatus: unaffected
packageName: Studio
platforms: [Linux, MacOS, Windows, x86, ARM, 64 bit]
product: CrafterCMS
vendor: CrafterCMS
versions:
lessThanOrEqual: 4.0.1, status: affected, version: 4.0.0, versionType: semver
lessThanOrEqual: 3.1.26, status: affected, version: 3.1.0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL