This vulnerability in DOTonPAPER Pinpoint Booking System arises from improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. It affects versions up to 2.9.9.5.1. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact but no integrity impact and low availability impact. No patch or vendor advisory information is currently available, and the product is not a cloud service.

Successful exploitation can lead to unauthorized disclosure of sensitive data due to high confidentiality impact. The integrity of data is not affected, but availability impact is low, possibly causing limited denial of service. The vulnerability requires low privileges and network access but no user interaction. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected system and monitor for unusual database query patterns indicative of SQL injection attempts. Avoid exposing the booking system to untrusted networks. Follow up with DOTonPAPER for updates on patches or official mitigations.