This vulnerability involves improper neutralization of special elements in SQL commands within captivateaudio Captivate Sync (up to version 3.2.2), enabling Blind SQL Injection attacks. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No known exploits in the wild or vendor patch information are currently available.

Successful exploitation could allow an attacker with high privileges to extract sensitive information from the database (confidentiality impact is high) without affecting data integrity but with limited impact on availability. The vulnerability could lead to unauthorized disclosure of sensitive data due to Blind SQL Injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application to trusted users with necessary privileges only and monitor for unusual database query patterns indicative of SQL Injection attempts.