This vulnerability in VeronaLabs Slimstat Analytics (versions <=5.4.11) is an improper neutralization of special elements used in an SQL command (CWE-89), resulting in blind SQL injection. The CVSS 3.1 score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability allows an attacker to extract sensitive data from the database without direct feedback (blind SQLi). No known exploits are reported in the wild, and no official patch or remediation level has been published as of the data provided.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact) and a minor impact on system availability (low availability impact). Integrity is not affected. The attack requires network access and low privileges but no user interaction, and it changes the security scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Slimstat Analytics installations to trusted users only and monitor for suspicious activity related to SQL injection attempts.