This vulnerability in ARPrice (<= 4.1.3) allows SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 8.5 (high), with attack vector network, low attack complexity, requiring low privileges and no user interaction. The impact includes high confidentiality compromise and low availability impact. No patch or vendor advisory is currently provided, and it is not a cloud service. Exploitation could allow unauthorized data disclosure and partial service disruption.

Successful exploitation could lead to unauthorized disclosure of sensitive information (high confidentiality impact) and partial denial of service (low availability impact). Integrity impact is not indicated. The vulnerability requires network access and low privileges but no user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict network access to the affected ARPrice installation and monitor for unusual database activity. Avoid exposing the vulnerable version to untrusted networks.