This vulnerability, identified as CWE-89, exists in Do Lasso versions up to 358. It involves improper neutralization of special elements used in SQL commands, specifically in the subscriber functionality, which can be exploited remotely over the network with low complexity and privileges. The CVSS 3.1 score is 8.5, indicating a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No official patch or remediation information is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to access sensitive data (high confidentiality impact) without affecting data integrity but causing a low impact on availability. The attack can be performed remotely with low privileges and no user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.