This vulnerability, identified as CWE-89, involves improper neutralization of special elements used in SQL commands within the Paperwork software by GG Soft Software Services Inc. It enables SQL injection attacks, which can compromise the confidentiality and integrity of the database. The affected versions include all releases up to 2026-09-09. The CVSS v3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, requiring low privileges and no user interaction, impacting confidentiality highly and integrity partially, without affecting availability.

Successful exploitation of this SQL injection vulnerability could allow an attacker with low privileges to execute unauthorized SQL commands remotely, leading to high confidentiality impact (such as data disclosure) and partial integrity impact (such as data modification). Availability is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates and apply any official patches once available. Until then, restricting database permissions and applying input validation where possible may reduce risk.