This vulnerability in designthemes LMS (versions up to 9.2) arises from improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. The issue allows remote attackers to execute arbitrary SQL commands without authentication, potentially leading to unauthorized disclosure of sensitive information. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges or user interaction needed. The impact is primarily on confidentiality with some impact on availability. No patch or official remediation guidance is currently available.

Successful exploitation could allow an attacker to extract sensitive data from the LMS database, compromising confidentiality. The vulnerability does not directly affect integrity but may have a limited impact on availability. Given the critical CVSS score of 9.3, the risk to affected systems is high if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or mitigations recommended by the vendor. Monitoring for unusual database activity and restricting network access to the LMS may help reduce exposure but are not definitive mitigations for this vulnerability.