CVE-2025-47671 describes an SQL Injection vulnerability in LETSCMS MLM Software's Binary MLM Plan (versions up to 3.0). The vulnerability is due to improper neutralization of special elements in SQL commands, which can be exploited by an attacker with high privileges to affect the confidentiality and availability of the system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, with high confidentiality impact, no integrity impact, and low availability impact. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to execute crafted SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability affects all installations of Binary MLM Plan up to version 3.0.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is available, users should monitor the vendor's communications for updates. In the meantime, restricting access to trusted users with high privileges and applying principle of least privilege may reduce risk.