This vulnerability in Bob Hostel software arises from improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. It affects versions up to 1.1.5.6 and requires the attacker to have high privileges. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) due to Blind SQL Injection. Integrity is not impacted, and availability impact is low. The attacker must have high privileges, which limits the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restricting high privilege access and reviewing input validation for SQL commands may reduce risk.