The vulnerability exists in the signIn endpoint of SAT CFDI 3.3, allowing an attacker to inject arbitrary SQL through the 'id' field of a POST request. By using boolean‑based blind, stacked, or time‑based payloads, an attacker can read or modify database contents, leading to potential data exposure, unauthorized access, or compromise of the application. The weakness is a classic SQL injection (CWE‑89) that threatens confidentiality, integrity, and availability.

Products affected are SAT CFDI 3.3 from Wecodex. No additional vendor or version details are specified beyond the 3.3 release, making this the primary affected version.

The CVSS score of 8.8 indicates high severity, and since the vulnerability is accessible through a web endpoint, the attack vector is remote. EPSS data is not available, but the lack of a CISA KEV listing does not negate the risk; the potential for exploitation remains significant. Attackers would need network access to the web server hosting SAT CFDI and could exploit the signIn endpoint without authentication, exercising the SQL injection directly. Given the high score, timely remediation is essential.