This vulnerability is an SQL injection (CWE-89) in Zeon Academy Pro, specifically in the handling of the 'phonenumber' parameter via POST requests to '/private/continue-upload.php'. An attacker can exploit this flaw to execute unauthorized SQL commands, potentially leading to full database compromise including data retrieval, modification, and deletion. The CVSS 4.0 score of 9.3 reflects network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by Zeon Global Tech, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an unauthenticated attacker to perform arbitrary SQL commands on the backend database, potentially leading to full compromise of stored data including unauthorized retrieval, creation, modification, and deletion of database records. This can severely impact confidentiality, integrity, and availability of the affected system's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor the vendor's communications for updates. Until a patch is available, restricting access to the vulnerable endpoint and employing web application firewalls with SQL injection detection rules may help reduce risk.