This vulnerability involves improper neutralization of special elements in SQL commands within the JS Help Desk product by JoomSky, specifically in the js-support-ticket component. It permits blind SQL injection attacks, enabling an attacker with network access and low privileges to extract sensitive data from the backend database. The CVSS 3.1 score is 8.5, reflecting high confidentiality impact, low attack complexity, and no required user interaction. The affected versions include all versions up to 3.0.1.

Successful exploitation could allow an attacker to extract sensitive information from the database (high confidentiality impact) and cause limited disruption to availability. Integrity impact is not indicated. The attack requires low privileges and network access but no user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor JoomSky communications for updates. Until a fix is available, consider restricting network access to the affected component and applying any available workarounds recommended by the vendor.