This vulnerability in Themefic Hydra Booking (<= 1.1.32) involves improper neutralization of special elements used in SQL commands, leading to SQL Injection. The CVSS 3.1 score of 8.5 indicates an attacker can exploit this remotely with low complexity and low privileges, without user interaction, to compromise confidentiality and cause limited availability impact. The vulnerability is publicly known but no patch or official fix has been documented yet.

Successful exploitation could allow an attacker to execute unauthorized SQL commands, potentially exposing sensitive data (high confidentiality impact) and causing limited denial of service (low availability impact). Integrity impact is not indicated. The vulnerability requires low privileges but no user interaction, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting database permissions and monitoring for unusual database activity related to Hydra Booking. Avoid exposing the affected application to untrusted networks if possible.