CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 4.0
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: deepwoods software weblibrarian 3.5.2 and earlier is affected by: sql injection. the impact is: exposing the entire database. the component is: function "allbarcodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection. this function call can be triggered by any user logged-in with at least volunteer role or manage_circulation capabilities. poc : /wordpress/wp-admin/admin.php?page=weblib-circulation-desk&orderby=title&order=desc.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2019-07-15
Last Modified Date: 2019-08-21