This vulnerability in Grit42 Grit (up to version 0.11.0) involves an SQL injection flaw in the GritEntityController component, specifically in the file modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb. An attacker can remotely trigger this vulnerability by manipulating input to the affected functionality, resulting in unauthorized SQL commands being executed. The vendor was notified but did not provide a response or fix. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. No official remediation or patch is currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impacts as per the CVSS vector. There are no confirmed reports of exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor, who has not responded to the disclosure. Users should consider implementing application-level input validation and SQL query parameterization as temporary mitigations to reduce the risk of exploitation. Monitor for updates from the vendor for an official fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.