The vulnerability resides in a login form that processes user input without proper sanitization. An unauthenticated attacker can submit a crafted POST request to the controller endpoint, inserting SQL commands in the username field. This flaw permits execution of arbitrary database queries, allowing the attacker to read, modify, or delete sensitive data, or to bypass authentication entirely. The weakness aligns with CWE‑89, leading to potential loss of confidentiality and integrity of the application database.

This flaw affects Sourceforge's OpenBiz Cubi Lite product, specifically version 3.0.8. Only this version is known to be affected according to the available CNA data.

The vulnerability is rated high with a CVSS score of 8.8, indicating a severe impact when exploited. Although EPSS data is unavailable, the absence from the KEV catalog does not mitigate the threat, as the flaw allows unauthenticated data access over the network. Attackers can exploit the flaw remotely via the public web interface, requiring no credentials. Due to the straightforward nature of the injection and the lack of authentication, the barrier to exploitation is low.