This vulnerability involves improper neutralization of special elements in SQL commands within the JoomSky JS Help Desk product, specifically in the js-support-ticket component. It allows an attacker with low privileges to conduct blind SQL injection attacks, which can compromise the confidentiality of the database and cause limited denial of service. The affected versions include all versions up to 3.0.3. The CVSS v3.1 score is 8.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection, potentially extracting sensitive information from the database (high confidentiality impact). The vulnerability does not affect data integrity but may cause limited denial of service (availability impact). There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected JS Help Desk versions and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable component to untrusted networks if possible.