This vulnerability involves improper neutralization of special elements used in an SQL command (CWE-89) within the Giving Reports feature of Ellucian Advance Web and Legacy Advance. Authenticated users can exploit this SQL Injection flaw by submitting malicious input in the class credit field, potentially allowing unauthorized extraction of sensitive data from the backend database. The issue affects all versions of Advance Web and Legacy Advance, while Ellucian CRM Advance is not impacted. The CVSS 4.0 base score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker to extract sensitive information from the database, compromising confidentiality and potentially affecting data integrity and availability. The vulnerability affects all versions of Ellucian Advance Web and Legacy Advance, posing a critical risk to organizations using these products.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, organizations should monitor Ellucian's advisories for updates. Until a patch is available, restrict access to the affected functionality to trusted users only and consider additional input validation or web application firewall rules to mitigate exploitation risk.