This vulnerability involves improper neutralization of special elements used in an SQL command within the MyStyle Custom Product Designer product by mystyleplatform. Specifically, it allows Blind SQL Injection attacks, enabling an attacker to infer sensitive information from the database. The affected versions include all releases up to and including 3.21.1. The CVSS v3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. Confidentiality impact is high, integrity impact is none, and availability impact is low.

Successful exploitation can lead to unauthorized disclosure of sensitive data from the backend database due to Blind SQL Injection. The integrity of data is not impacted, but availability may be slightly affected. The vulnerability is exploitable remotely without authentication or user interaction, increasing the risk of widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting this product. Review and harden database query handling to ensure proper input validation and parameterization where possible.