This vulnerability (CVE-2025-6520) in Abis Technology BAPSIS is due to improper neutralization of special elements in SQL commands, classified as CWE-89. It allows blind SQL injection attacks, which can be exploited remotely without privileges or user interaction. The affected versions are all prior to 202510271606. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized disclosure, modification, or destruction of data within the BAPSIS system. This can compromise the entire database and potentially the underlying system, severely impacting confidentiality, integrity, and availability of the affected product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the affected BAPSIS instances and monitor for unusual database activity. Avoid exposing the vulnerable service to untrusted networks.