This vulnerability in Infility Infility Global (up to version 2.15.06) allows SQL Injection due to improper neutralization of special elements in SQL commands. An attacker with network access and low privileges can exploit this to execute unauthorized SQL queries, potentially exposing sensitive information. The CVSS 3.1 score is 8.5, reflecting high confidentiality impact, no integrity impact, and low availability impact. There is no indication that this is a cloud service, and no known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). Integrity is not impacted, and availability impact is low. The vulnerability requires low privileges and no user interaction but network access. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is provided in the available data, monitor vendor communications for updates. Limit network exposure of the affected application and restrict privileges where possible until a fix is available.