i-doit CMDB 1.12 exposes an unauthenticated SQL injection flaw in the objGroupID parameter. Attackers can craft GET requests that inject malicious SQL code, allowing execution of arbitrary queries. The exploit can expose sensitive information such as usernames, database names and version information, thereby compromising the confidentiality of the system's data assets.

This vulnerability affects the i-doit CMDB product from I-Doit, specifically version 1.12. No other versions are listed as affected in the available information.

The CVSS base score of 8.8 classifies the vulnerability as high severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector, as described, is web‑based; an attacker can send unauthenticated HTTP GET requests to the victim's server to trigger the injection. Given the impact and the remote nature of the attack, the risk is significant even though the exploit probability is currently low.