This vulnerability in LambertGroup - AllInOne - Banner with Playlist (versions up to 3.8) is due to improper neutralization of special elements in SQL commands, enabling blind SQL injection. An attacker with low privileges can exploit this remotely without user interaction, potentially compromising confidentiality and causing limited availability issues. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability affects data confidentiality primarily through blind SQL injection techniques.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application to trusted users and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.