This vulnerability in Fox LMS involves improper neutralization of special elements in SQL commands, enabling Blind SQL Injection attacks. It affects versions up to 1.0.6.3 and can be exploited remotely with low attack complexity and low privileges. The vulnerability can lead to a complete confidentiality breach of the database and cause limited availability issues. The CVSS score is 8.5, indicating high severity. No vendor advisory or patch information is currently provided.

Successful exploitation can result in high confidentiality impact by allowing attackers to extract sensitive data via Blind SQL Injection. Integrity is not impacted, and availability impact is low. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and parameterized queries as temporary mitigations if possible. Monitor vendor communications for updates on patches or official fixes.