This vulnerability in Shamalli Web Directory Free (versions up to 1.7.6) arises from improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. An attacker can exploit this remotely without authentication or user interaction, potentially leading to unauthorized disclosure of sensitive information. The CVSS 3.1 vector indicates a critical severity with high confidentiality impact and low availability impact. No patch or official remediation guidance is currently provided, and the product is not a cloud service.

Successful exploitation could allow an unauthenticated remote attacker to extract sensitive information from the backend database via Blind SQL Injection. The confidentiality of data is highly impacted, while integrity is not affected and availability impact is low. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying web application firewall (WAF) rules to detect and block SQL injection attempts specific to this product. Avoid exposing the vulnerable application to untrusted networks if possible.