This vulnerability (CVE-2025-4764) involves improper neutralization of special elements used in SQL commands (CWE-89) within the Hotel Guest Hotspot product by Aida Computer Information Technology Inc. It enables SQL Injection attacks, which can compromise confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.0, indicating high severity, with attack vector being adjacent network, low attack complexity, requiring low privileges and no user interaction. The vendor has not provided any response or patch, and no known exploits are reported in the wild.

Successful exploitation of this SQL Injection vulnerability could allow an attacker with adjacent network access and low privileges to execute arbitrary SQL commands. This can lead to full compromise of the affected system's data confidentiality, integrity, and availability. Given the high CVSS score and the nature of SQL Injection, the impact is significant, potentially allowing data theft, data manipulation, or denial of service.

Patch status is not yet confirmed — no patch or official remediation has been provided by the vendor. Users should monitor the vendor's communications for any updates. Until a fix is available, consider restricting access to the affected system to trusted users and networks only, and apply any available compensating controls to limit SQL injection risks. Avoid exposing the vulnerable service to untrusted networks.