This vulnerability in AA-Team WZone (versions up to 14.0.31) involves improper neutralization of special elements in SQL commands, enabling blind SQL injection. An attacker with network access and low privileges can exploit this to extract sensitive data from the backend database, impacting confidentiality. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, no user interaction, and partial impact on availability.

Successful exploitation could allow an attacker to retrieve sensitive information from the database without authentication or user interaction, compromising confidentiality. The integrity is not impacted, and availability impact is low. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the affected WZone plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks.