CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.4
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: an exploitable sql injection vulnerability exists in the unauthenticated portion of efront lms, versions v5.2.12 and earlier. specially crafted web request to login page can cause sql injections, resulting in data compromise. an attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/NONE
Published Date: 2019-09-05
Last Modified Date: 2019-09-06