This vulnerability involves an SQL Injection flaw in Bottinelli Informatica Vedo Suite v1.2.5. The flaw exists in the api_vedo/chat endpoint, specifically through the utente_chat parameter, which can be manipulated by a remote attacker to execute arbitrary code on the affected system. The vulnerability is publicly disclosed but lacks detailed CVSS scoring and vendor remediation guidance at this time.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access or control. However, no active exploitation has been reported, and the extent of impact depends on the deployment context of the affected software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint and monitor for unusual activity related to the api_vedo/chat endpoint. Avoid exposing the vulnerable service to untrusted networks if possible.