This vulnerability affects the mjperpinosa stumasy product up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The issue is a SQL injection in the Notes_controller::search_scratch_data function located in application/PHP/objects/notes/search_scratch_data.php. Attackers can manipulate the field_name parameter remotely to inject SQL commands. The product's rolling release model means no discrete version numbers are available for affected or fixed releases. The vendor has been notified but has not issued a fix or official response. Public exploit code exists, indicating the vulnerability is known and potentially exploitable.

Successful exploitation could allow an attacker with low privileges to remotely execute SQL injection attacks, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported yet, but public exploit code is available.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation level is provided, users should monitor the vendor's advisories for updates. Until a patch is released, consider implementing application-layer input validation or web application firewall (WAF) rules to detect and block malicious SQL injection attempts targeting the field_name parameter.