Description (CNA)
The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes from the tbl_users database table. Attackers can exploit the /frontend/get_article_suggestion/ endpoint by crafting malicious search parameters to progressively guess and retrieve user credentials through boolean-based inference techniques.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| codexcube / Ultimate Project Manager CRM PRO | affected <= 2.0.5 |
CWE
CWE-89
References
- https://www.exploit-db.com/exploits/48912
- https://ultimatepro.codexcube.com/
- https://www.vulncheck.com/advisories/ultimate-project-manager-crm-pro-sqli-credentials-leakage
ADP enrichment
No English description supplied.
No references supplied.