This vulnerability in DirectIQ Email Marketing (up to version 2.0) is due to improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score of 9.3 reflects a network attack vector with low attack complexity, no privileges or user interaction required, and a scope change. The impact is high confidentiality loss and low availability impact, with no integrity impact reported. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An attacker can remotely exploit this vulnerability without authentication or user interaction to execute arbitrary SQL commands on the backend database. This can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity of data is not directly affected according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict network access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable version publicly if possible.