This vulnerability in Ays Pro Quiz Maker (up to version 6.6.8.7) is caused by improper neutralization of special elements used in SQL commands, resulting in an SQL Injection flaw. This allows an attacker to manipulate SQL queries executed by the application. The CVSS 3.1 score of 8.2 reflects a network attack vector with low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation could allow an attacker to execute unauthorized SQL commands, potentially leading to disclosure of sensitive information (high confidentiality impact) and limited denial of service (low availability impact). Integrity is not impacted according to the CVSS vector. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates and apply them promptly once available. Until a fix is released, consider restricting access to the affected application and limiting user input that could trigger SQL injection. Avoid exposing the vulnerable application to untrusted networks if possible.