This vulnerability in lock-upme OPMS up to commit 831440f37a92c1568f2e071d5233bc873a9d8b09 involves an SQL injection flaw in an unknown function within controllers/messages/message.go, specifically in the IN Clause Handler component. Attackers can remotely exploit this by manipulating the 'ids' argument, leading to SQL injection. Due to the rolling release model, precise affected versions cannot be identified. The vendor has not issued any advisory or patch, and remediation status is unknown.

Successful exploitation could allow an attacker with low privileges to perform SQL injection remotely, potentially leading to unauthorized data access or manipulation. The CVSS 4.0 base score is 5.3 (medium), indicating limited impact with no user interaction required and low complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for vendor updates and consider implementing application-layer protections such as input validation or web application firewalls to mitigate SQL injection risks.