CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. It involves a SQL injection risk. Exploitation may require the attacker to be authenticated.
Original NVD Description
BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoint that is responsible for issuing self-service password resets). An unauthenticated attacker is able to send a request containing a crafted payload that can result in sensitive information being extracted from the database, eventually leading into an application takeover. This vulnerability was introduced as a result of the developer trying to roll their own sanitization implementation in order to allow the application to be used in legacy environments.
Related CVEs
Other vulnerabilities affecting the same vendor(s)