This vulnerability is an improper neutralization of special elements used in an SQL command (SQL Injection) in the appsbd Vitepos vitepos-lite product. It allows blind SQL injection attacks, which can lead to unauthorized disclosure of sensitive information. The affected versions include all versions up to and including 3.4.2. The CVSS 3.1 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity impact and low availability impact. There is no vendor advisory or patch information available at this time.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to perform blind SQL injection attacks. This can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and may cause limited disruption to availability. Integrity is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access to the affected service and monitoring for unusual database query patterns related to SQL injection attempts.