The ComMotion Course Booking System up to version 6.0.6 contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows remote attackers to execute crafted SQL queries without authentication, potentially leading to unauthorized data disclosure and limited denial of service. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and availability.

Successful exploitation can result in unauthorized disclosure of sensitive data and partial denial of service conditions in the affected Course Booking System. The vulnerability does not impact integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended temporary mitigations from the vendor or restrict access to the vulnerable system to trusted networks. Monitor vendor channels for updates regarding patches or official fixes.