This vulnerability involves improper escaping of backslashes in parameters provided by attackers, leading to trivial SQL injection in PHP. The affected versions include all releases before 8.2.33, 8.3.33, 8.4.24, and 8.5.9. The vulnerability is categorized under CWE-89, indicating improper neutralization of special elements used in SQL commands. The CVSS 4.0 score is 8.1, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, but high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are provided, and the remediation level is not specified.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform SQL injection attacks, potentially leading to unauthorized data access, data modification, or denial of service. The high CVSS score indicates significant impact on confidentiality, integrity, and availability of affected systems running vulnerable PHP versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications closely and consider applying any recommended temporary mitigations once published.