The L-ONE v1.0.0 software has multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList endpoint. The vulnerabilities are triggered through the busid, id, and taskid parameters, enabling attackers to execute arbitrary SQL queries and potentially access sensitive data stored in the database. The CVE record does not provide a CVSS score or detailed vendor remediation information, and no known exploits have been reported.

Successful exploitation could lead to unauthorized access to sensitive database information, potentially exposing confidential data. However, no active exploitation has been reported, and the extent of impact depends on the database contents and deployment environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the vulnerable endpoint publicly and consider implementing input validation or web application firewalls to mitigate SQL injection risks.