This vulnerability, identified as CVE-2025-32203, affects the Falling things product by manu225 up to version 1.08. It is caused by improper neutralization of special elements in SQL commands, leading to an SQL Injection vulnerability. The CVSS 3.1 base score is 7.6, indicating high severity, with an attack vector of network, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

An attacker with high privileges can exploit this SQL Injection vulnerability to potentially access or disclose sensitive information from the database, impacting confidentiality. The vulnerability does not affect data integrity but may cause limited availability issues. Since exploitation requires high privileges, the risk is somewhat mitigated by the need for elevated access. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege access to the affected product and monitor for unusual database activity. Avoid exposing the vulnerable versions to untrusted networks. Follow up with manu225 for updates on patches or official mitigations.