The scriptsbundle Exertio Framework versions up to 1.3.3 suffer from an improper neutralization of special elements in SQL commands, resulting in a blind SQL Injection vulnerability. This allows remote attackers with low privileges to inject SQL commands, potentially exposing sensitive data (confidentiality impact is high) and causing limited denial of service (availability impact is low). The vulnerability does not impact data integrity. The CVSS 3.1 score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation can lead to unauthorized disclosure of sensitive information due to blind SQL injection. The vulnerability does not allow modification of data (integrity impact is none) but can cause limited disruption to service (low availability impact). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation and parameterized queries as temporary mitigations if possible. Monitor vendor channels for updates regarding patches or official mitigations.