This vulnerability in LambertGroup AllInOne - Banner Rotator (<= 3.8) is due to improper neutralization of special elements in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact and low availability impact. The vulnerability could allow an attacker to access sensitive data via crafted SQL queries.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability requires low privileges but no user interaction, increasing the risk in environments where the plugin is deployed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the affected component to untrusted networks if possible.