This vulnerability involves improper neutralization of special elements used in SQL commands within the Martí Batlles Martinez Mimoos devoluciones-packback component, allowing SQL Injection attacks. The affected versions include all versions up to 1.2. The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and a scope change. The impact is high confidentiality loss and low availability impact, with no integrity impact reported. No known exploits in the wild or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and consider applying any forthcoming patches promptly. Until a fix is available, restricting access to the affected component and applying input validation or web application firewall rules targeting SQL injection patterns may help mitigate risk.