CVE Catalog
CVE-2017-7410
CriticalSummary
Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter.
Risk Assessment
An attacker could exploit these vulnerabilities to gain unauthorized access to the database, potentially leading to data theft or system compromise.
Recommendation
It is recommended to upgrade to the latest version of WebsiteBaker and implement input filtering and validation in registration forms.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter.