This vulnerability in Arraytics Booktics (up to version 1.0.22) is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). It enables blind SQL injection attacks due to insufficient sanitization of input used in SQL queries. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker with low privileges to perform blind SQL injection attacks remotely, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). Integrity is not affected, and availability impact is low. The scope is changed, indicating that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing application-level input validation and use of parameterized queries or prepared statements as a temporary mitigation.