This vulnerability in Nelio AB Testing (<= 8.2.4) is due to improper neutralization of special elements in SQL commands, enabling blind SQL injection. The CVSS 3.1 score is 7.6, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability allows an attacker with high privileges to extract data via blind SQL injection techniques.

An attacker with high privileges on the affected system can exploit this vulnerability to perform blind SQL injection attacks, potentially leading to unauthorized disclosure of sensitive database information. The integrity of data is not impacted, and availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to the Nelio AB Testing plugin and monitor for suspicious activity related to SQL injection attempts.