This vulnerability in NSquared Simply Schedule Appointments involves improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. It affects versions up to 1.6.9.27. The CVSS score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction. The impact is high confidentiality loss and low availability impact. No official remediation or patch has been documented yet.

An attacker with low privileges can exploit this vulnerability remotely to perform blind SQL injection, potentially extracting sensitive data from the backend database (high confidentiality impact). The integrity impact is not indicated, and availability impact is low, possibly causing minor service disruption. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected application to trusted users only and monitor for unusual database activity related to SQL injection attempts. Avoid exposing the vulnerable version publicly if possible.