This vulnerability in guelben Bravo Search & Replace (<= 1.0) involves improper neutralization of special elements in SQL commands, leading to Blind SQL Injection. An attacker with high privileges can exploit this to extract confidential information from the database without user interaction. The CVSS 3.1 score is 7.6, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and a scope change with high confidentiality impact, no integrity impact, and low availability impact. No patch or official fix information is available at this time.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the backend database, compromising confidentiality. Integrity of data is not impacted, and availability impact is low. The attack requires high privileges, limiting the attack surface to privileged users. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application to trusted users only and monitor for suspicious activity involving database queries. Avoid exposing the vulnerable version in untrusted environments.