This vulnerability, identified as CWE-89, is an SQL Injection flaw in DigitalME eRoom software versions up to 1.7.1. It arises from improper neutralization of special elements in SQL commands related to contributor input. The CVSS 3.1 score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact scope is changed (S:C), with high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with low privileges to execute arbitrary SQL commands on the backend database, potentially exposing sensitive data (high confidentiality impact) and causing limited disruption to availability. Integrity impact is not indicated. The vulnerability affects the confidentiality of the system significantly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor privileges where possible and monitor for unusual database activity related to contributor inputs. Avoid exposing the vulnerable application to untrusted networks if feasible.