This vulnerability involves improper neutralization of special elements in SQL commands within Quý Lê 91 Administrator Z, enabling blind SQL injection attacks. The flaw affects versions before 2024.10.21 and can be exploited remotely with low attack complexity and low privileges. The CVSS 3.1 base score is 8.5, reflecting high confidentiality impact and limited availability impact, with no integrity impact. No vendor advisory or patch links are currently available, and the product is not a cloud service.

Successful exploitation could allow an attacker to extract sensitive data from the database (high confidentiality impact) and cause limited denial of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. However, no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for unusual database activity. Avoid exposing the application to untrusted networks. No official patch or workaround information is currently available.