The Saha365 App by Mobil365 Informatics contains an SQL Injection vulnerability (CWE-89) that arises from improper neutralization of special elements in SQL commands. This flaw allows remote attackers to execute arbitrary SQL code without authentication, potentially leading to full compromise of the affected system's database. The vulnerability affects all versions of the app released before 30.09.2024. The CVSS 3.1 base score of 9.8 reflects the vulnerability's ease of exploitation (network vector, no privileges or user interaction required) and severe impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to unauthorized disclosure, modification, or deletion of sensitive data stored in the backend database. It may also allow attackers to execute administrative operations on the database, potentially resulting in complete system compromise. Given the critical CVSS score, the impact on affected systems is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected application and monitor for unusual database activity. Avoid exposing the application to untrusted networks. Follow up with Mobil365 Informatics for updates on patches or mitigations.